If I take a VM, and upload my website's code to the server - can the hosting company see my code?
When the VM is created, it creates a *file* on the disk, right? Is this encrypted/inaccessible? Unless anyone at the data centre has the root password of the VM, they can't access this code, right?

If you have not personally encrypted the disk with a passphrase then you should assume the hosting company has the passphrase and can see any file on there.
They also probably have access to view your VM display just the same way you do, so anything you see on the screen they can see too.

It's a VM, of course there's admin access.
You would do well to encrypt before you store (any-damn-where).

If you did not encrypt yourself the data with a passphrase known only to you, they don't need ANY password to access your data. They can copy or/and mount the virtula drive of your VM and access everything on it.

Generally a VM uses a file or collection of files. The file(s) is/are used like a hard drive. Some call it a virtual hard drive. Some people use the host computer's OS and file system to encrypt the file(s).

Starting at VirtualBox 5 they added in a “Disk Image Encryption” that I'd assume to be rather secure and outside the host filesystem level.

The client within the VM also has ways to encrypt file or directory or partition or whole disk.

Unless you perform some sort of encryption then it is likely that the hosting company can access the data.