It’s not making money off of open source, it’s making money off of hosting open source.
If we define "open source" as "you can't necessarily use this to train an AI", then Copilot itself is illegal because it's using code without permission.
If we define "open source" as "you can use this to train an AI", then Copilot it legal, but GitHub may be illegally misrepresenting itself as a host for "open source", as the policy it hosts code under isn't truly open-source.
If we define "open source" as "you can't necessarily use this to train an AI" but then GitHub's policy explicitly states "by using us as a hosting provider, you give us permission to use your code to train AI" then they are in the clear. But I doubt they have that clause or at least had it when Copilot was first revealed.