I'm not an expert on copywrite issues, GPL or "derivative work", but here's my explanation of the situation.
The engine is open source (client, server, graphics). Some of the media is open source. The game or mod (gamex86.dll/.so) is closed source since it was not licensed at the time it was released (q2src320.exe -- 3yrs prior to engine code being open source). jitspoe has taken advantage of this and uses the game code to hide his global login, cheat detection and whatever else he doesn't want us to see. Good for keeping the game somewhat free of grievers, but bad for letting other people make their own improvements to things like game modes, chase camera, stats, global login integration or bot AI.
You can compile the engine code without having PB2's mod source. You can not use these copies to play on Internet Public Servers (sv_public 1) without being detected for a modified client, if your server is on LAN/Internet with sv_public 0 then you should be able to play with modified clients without much worry.
As for developer participation, this hasn't been a "team effort" for over half a decade. It's someone's personal project and a lot of people's pastime. I would love to see this project take on more of the open-source culture and attract talented developers to improve the game, but that's a lot of change for one person to make on decently stable and mature project.