What is the business model? Could this be acquired and ruined?

Paid hosting, for people who would rather not run it themselves.

The protocol and the reference server are Apache-2.0, and that is the hedge: if the hosted service ever goes bad, the thing you actually depend on does not go with it. That is the only structural guarantee on offer, and it is a better one than a promise about anybody's future intentions.