"If someone works at source code level, who owns that work and what can they do with it?"
For new components, ROL have various template agreements that a programmer can pick to suit them. Generally speaking, they range from 'the author owns it and ROL have a license to redistribute it' to 'The author hands over all ownership to ROL'. I picked the latter for the bits and pieces I contributed to Select because if a major bug was discovered, and I was too busy to fix it, there should be no barrier to stop ROL fixing it or updating it and issuing a release to end users.
Components already owned by ROL remain ROL's. Core components are things like the Kernel which require a full-time effort and experience of working with the ROS source to safely understand how they work. Non-core will, mostly, be components like ChangeFSI, Configure plugins, etc. Developing these takes the pressure off the few people left who can navigate the core stuff.
This is speaking from my own experiences, I could be wrong.