Eric Ries intimated in "Lean Startup" that nobody would steal our ideas, but I have concerns with an external agency or developers having possession of source code that would be the core of our business. Is this an unfounded fear? When funding permits, I would like to explore having an in-house development team, but quality agencies and developers seem to be available to hire in abundance. If my startup is bringing in revenue and profiting, is it unusual to continue a working relationship by outsourcing development to a third party? I'm thinking in the most economical sense, that this is sensible, however there are certainly other concerns to consider.
It's not unusual at all. If you do outsource, try and make sure you have a project lead that you can trust. Once revenues get up to a certain point they might want to see the project through and come on board full time OR they will have enough pride in their work to make sure a proper transition takes place.
As far as security, make sure you have an airtight non-disclosure/non-compete agreement with a penalty clause that includes financial remuneration.