But still, someone could hypothetically roll up with a big bag of cash and try to get a license for all non-Hashicorp commits.

I don’t really see what the point of that would be though, since they would still be missing the (presumably large) part written by Hashicorp.

So what Hashicorp is saying is that they are the only ones that can (/have?) released their software under a closed license, thanks to their CLA.

But (as they themselves say in other places in the filing) they are still vulnerable to someone offering e.g hosted versions / forking and selling support or other complimentary closed source software, like plugins.