WebCore and JavaScriptCore are based off KHTML and KJS, but WebKit (which unites the two into a usable API) is Apple code and doesn't have to be open source (it was closed source until 2005).
It doesn't have to be run in the open; they have to release the source whenever they release a new Safari update, but they don't have to do project administration in public or let anyone else access their SVN. This is how several of the Darwin opensource projects work, notably Apple's gcc branch and the kernel.
