My experience suggests that when management says "security" and implements a stupid policy, they are extremely unlikely to respond well to any employees who demonstrate how stupid the policy is.

Secondly copying the code and inserting it into the codebase carries very real intellectual property risks. Copying a freely available snippet from a website carries far smaller risks, particularly when the author is available to give permission.

So yeah, it is a stupid rule. But I wouldn't recommend breaking it in an obvious way.