So perhaps setting the bar at "completely open" is setting it too high. A more appropriate standard may be "open enough to be trusted, at least for now".
That second bar is one that companies like GitHub and Atlassian clear easily, while other companies that grew up under the traditional proprietary enterprise model don't.