It is an open source architecture but it doesn’t prevent the OEM from adding anything to it to prevent user from doing anything on it. They can add TPM, locked bootloader with fixed signing key stored on board. They can add microprocessor inaccessible to anyone but OEM. They can add spyware, malware. All this without any need for declaring it or need to make it open source.

The only change RISC V brings is there is no need to pay for a hardware architecture, benefitting the manufacturer. Rather than bringing freedom to the user.