This is a natural consequence of releasing an open source project.
It’s the equivalent of leaving a car open with a key, documents and an invitation to drive it for free.
Anyone else is free to use said driver, but in this case if they make him faster they have to make their changes public because of the GPL
Related to this: the GPL's obligations about sharing the source, kick in if you're sharing the binary. It's not relevant whether you made any changes yourself. [0] For compliance, the lazy derivative product will have to make the source available. I wonder if they've done that.
[0] https://www.fsf.org/bulletin/2020/fall/why-providing-source-...