If I'm remembering right, it was weirder than that, as Llama's originally release strategy was sort of bizarre.

You did have to apply for access, but if you met their criteria (basically if you were the right profile of researcher or in government), you got direct access to the model weights, not just an API for a hosted model. So access was restricted, but the full weights were shared.

I believe that the model was leaked by multiple people, some of which didn't work at Meta but had been granted access to the weights.