Stricter NDAs protect against insiders, not outsiders.

More security restrictions yes, that will work, but unless you actually go airgap all the code, there's an access point somewhere which can be vulnerable, either through the network or through the human init?