Sure, the GPL allows it, but the GPL doesnt allow Bob to dictate what Alice does with the source once she has it (GPL v2, term #4). If she decides to distribute it, his recourse is to not do further business with Alice. That could be enough, but if Alice sees sufficient short-term benefit, that may be a risk she is willing to take.