How come the server code was (is?) de-facto closed source and this fact was kept hidden?

In a project that claims to be open-source, privacy-focused and community-driven.