It means they haven't (yet?) transitioned to open-first and it'll require proving themselves that they'll do open-first development before trusting them. Not willing to bet my work on a product where the governance isn't open but everything is driven by and for a single company's needs.