The issue is trust. You have to really trust someone before you give him or her access to the code. Even if you only give him "read" access and force a trusted party to review, approve and commit his work, you still have to trust him not to abuse whatever info he might glean from having direct access to the code base.