You don’t need a public repo to be FOSS. You don’t need to accept changes. All you need is to provide a copy of the source code upon request. You can even automate that with a link to a tarball or something in the app.

My concern is less about privacy and more about security and longevity (i.e. what happens if they turn evil?). If it’s FOSS, I can audit the source and fork it if they go in a direction I don’t like. If it’s proprietary, I’m SOL if they turn evil or stop development. Projects like these tend to die.

I don’t really see any negatives here. The chance that someone makes a more popular fork is incredibly low, and the chance that someone audits it and points out a bug is a lot higher. They can retain control of the name, sell the software, etc. I really don’t see how providing source code is a downside.