I just did a compare between Arduino.cc and Arduino.org's pde.jar and arduino-core.jar files (the two files that really implement the Arduino IDE).
While the jar files differ on a binary compare, if you extract them and compare their contents, all of the .class files within are a perfect binary match. The only difference is the META-INF/MANIFEST.MF files.
Arduino.cc is compiling with:
Ant-Version: Apache Ant 1.9.4
Created-By: 1.8.0_111-b14 (Oracle Corporation)
Arduino.org is compiling with:
Ant-Version: Apache Ant 1.9.7
Created-By: 1.8.0_112-b15 (Oracle Corporation)
They both compiled exactly the same code and produced exactly the same JAVA bytecode. One of them had just a slightly newer version of the JDK toolchain installed on their build machine.
Lots of other files are different, but again is appears to be mostly related to Arduino.cc shipping java runtime 8.0.111 b14 and Arduino.org shipping java runtime 8.0.112 b15.
The main exe launcher is also different. I didn't dig into this, but since it doesn't do much, my guess is they've both signing it with their own code signing cert.
It's easy to leap to conclusions and assume the worst. But if you look at what's actually different, I'd say there's not much to see here. They both built from the same exact source, but used slightly different versions of Java to do their builds.