Maybe the code-stack then suddenly claims to be company-owned, so their company could claim our open source to be their code and thus try to put their rights to it, which is not allowed.

So just copying the code is allowed and would work as long as the original attributions are maintained, at which point he might not be allowed to copy open source code into their code-base.

Safety is sometimes subjective :)

I don't know if having a git repo with 10 years of history is enough proof to lawyers to acknowledge code property rights.