Even if New Vector did go evil (e.g: bought by EvilCorp; coerced into adding backdoors; tried to monetise user data/metadata; tried to relicense opensource stuff as proprietary; tried to add core functionality as paid-only) then both the Foundation and the wider ecosystem would fight back; rejecting the obnoxious changes to the spec, or simply going and supporting an alternative provider.
Meanwhile, if New Vector did implode, the team could still go elsewhere and keep working on Matrix if they wanted to - and there are an increasing number of folks who might hire them to do so. <plug>e.g. Automattic's new Matrix job opening! https://automattic.com/work-with-us/matrix-integrations-engi...
edit: the monetisation strategy for New Vector is selling Matrix hosting (https://modular.im) and helping out big folks like Governments who want to jump on board Matrix. While the company is certainly not profitable yet, it certainly has a path to being sustainable (otherwise folks like Automattic wouldn't invest!)
Thanks for this info! Exactly what I was looking for.
Even if they just "went Keybase" not having people outside of the org working on it would slowly bring them the XMPP fate (irrelevance).