Some of them, that I have asked, said, "we copied it from Debian/other operating system and look for sources there".
No, it's PERFECTLY LEGAL. Note that wording changed between GPL v2 and GPL v3 but from 6.b about Conveying Non-Source Forms of GPL v3 license (emphasis is mine):
Convey the object code in, or embodied in, a physical product (including a physical distribution medium), accompanied by a written offer, valid for at least three years and valid for as long as you offer spare parts or customer support for that product model, to give anyone who possesses the object code either (1) a copy of the Corresponding Source for all the software in the product that is covered by this License, on a durable physical medium customarily used for software interchange, for a price no more than your reasonable cost of physically performing this conveying of source, or (2) access to copy the Corresponding Source from a network server at no charge.
They should provide a written link to that repository (license requires an access with a reasonable effort for end-user). Note that when 6b doesn't apply then they are in case described by 6d and same reasoning is valid.
For example kernel of GNU operating system, Linux...
True. Note that kernel is licensed under v2 (exactly 2.0, not any other) and things are little bit different in wording (because v2.0 is an old license when network availability was not so wide. From 3.b you know that:
[source code] to be distributed under the terms of Sections 1 and 2 above on a medium customarily used for software interchange; or...
Note that generic wording "...medium customarily used for software interchange...". Nowadays Internet access is absolutely a medium customarily used for software interchange. Also note that again is required a written note about where you can get source code.
I didn't download those ISOs but I'd guess they include required information.
I'd define this behavior sloppy but not criminal (because license violations are criminal acts.)
As final note please do not forget that inside Debian distro there are software distributed with many different licenses (not only [L]GPL), that's a good reason to keep license information (it's pretty important) inside ISO where individual licenses can be addressed correctly. A real-world example of this? If you have an Android device you know...
What I'd suggest is to simply contact them and explain your perplexity about license terms. I think it may be ethical to provide required information in a more prominent place but legally speaking (however note that I'm not a lawyer) they're right.
Next paragraph isn't an answer to your question and it's just my very personal opinion about this topic. I guess it will be unpopular but that's it...
<rant>Open Source licenses are made to protect your rights to access source code, change it and improve your knowledge. To be useful they must be reasonable and compatible with real-world. Sadly there are many serious violations - not always in bona fide - however tilting at windmills doesn't help and it may be counterproductive.