We're talking early '90s here. Security was a thing of course, it meant you set a five-character root password on your FTP server ;-). MD5 wasn't even around so you had to trust that your source tarballs were not tampered with whatever the origins.

So whether I brought them from home or that company (if it had internet at all...) pulled them from gnu.org probably wouldn't have made a material difference. It was one of the reasons there was a big antipathy towards free software, at least with the vendor tapes you had someone to sue if they got tampered with.