That doesn't seem exactly right. RedHat isn't withholding any code from anybody, that are just distributing their kernel changes as a single patch and aren't providing an annotated changelog publicly. If you want the changelog and annotated individual change sets then you can be a subscriber, a subscription that can be terminated. The code is under the GPL, the bug tracker data is not.
IIts kind of silly as well because in most cases the individual change sets are also submitted and integrated into the mainline kernel. I don't know how many changes are only made in customer facing redhat kernels that aren't upstream, if any. Its probably hard to tell automatically because the same bug fix or feature might be coded slightly differently between different kernel versions