It's correct that bamboolib is (still) closed-source (which might be subject to change but I don't make promises).
It's also correct that customers can extend the bamboolib UI in various ways via plugins that they can author themselves. That empowers them to build bamboolib into the kind of tool that they want.
Also, all the code is always exported and thus, there is at least no "code lockin".
Regarding being "at their mercy", I can say that there are many customers who are happy by the service that we provide.