If I'm remembering right, it was weirder than that, as Llama's originally release strategy was sort of bizarre.
You did have to apply for access, but if you met their criteria (basically if you were the right profile of researcher or in government), you got direct access to the model weights, not just an API for a hosted model. So access was restricted, but the full weights were shared.
I believe that the model was leaked by multiple people, some of which didn't work at Meta but had been granted access to the weights.
I don't think it was much of a leak, there was no significant verification--I think .edu email approved automatically. It was probably just there because copyright law related to it was more uncertain then, but they had stronger fair use case with an academic/research gate on it.