In the case of CRAM as a part of Linux the ultimate control still lies with Linus Torvalds. Other Meta projects like for example zstd can be forked as soon as they do some fishy stuff with it. But I do agree, when Meta is in the role of maintainer, we should keep a close eye on how the projects develop.

If you’re concerned about this coming from Meta, you haven’t been paying attention. This is not to excuse Metas responsibility in the enshittification of the internet, but as a hyperscalar they of course have been pushing computing technology for a long time, and many of it openly available. CRAM will probably be upstreamed into Linux and I assume is therefore already licensed under the GPL. Meta Research seems to be operating in a much more open and useful way than the rest of the company.