I don't think that framing really tells us much, because there could be many reasons not to release that code that don't indicate it's an asset, such as (A) worries it might have still-relevant security issues, (B) costs of scrubbing other information like employee PII, or (C) the code is too useless to be worth the effort.

If the goal is to measure retained value, I'd ask how much a competitor would pay to acquire your 5-year-old code (for direct use, not for hacking you) without feeling cheated afterwards.