Correct. There’s no direct way to prove they are or aren’t using their own open source server code, but if they weren’t, the behavior could still be proven to match or be different, and as soon as the behavior is different, that would prove they’re not running the open source code, and if hypothetically they aren’t running their own open source code and they intend on avoiding detection of that fact, then they still have to make their closed-source infrastructure exactly match the behavior of the open source software. And as long as they’re doing that, then the open source functionality remains a perfect predictor of the behavior of their infrastructure. So it’s still pretty transparent in that sense. But technically, of course, we don’t really know, and that’s a given.

Self-hosting is still preferable, and the only method I consider personally acceptable.