Open source is one of the main reasons I recommended cal.com to everyone — I just did so yesterday again in fact!
I'm disappointed to hear this especially since I don't think the rationale makes sense, from what I understand of the security landscape, and it also makes me a little more skeptical of cal.com in general.