Proton’s server code is not Open Source because it contains filter and anti spam detection which if released, would severely hamper their ability to detect spam and keep their users safe + detect abuse for their service.
Proton has had extensive security audits done and their claims have been backed up by independent third parties.
The definition should be further modified to include legitimate reasons for not open sourcing some code + having audits to back up claims.