>Compare it to VirtualBox, which is clearly not F/OSS,

https://www.virtualbox.org/wiki/Downloads says

"The binaries are released under the terms of the GPL version 3" and the sources are here - https://www.virtualbox.org/browser/vbox/trunk

(up to V6.1, it was licensed under GPL v2 - https://www.virtualbox.org/wiki/GPL )

And VirtualBox is available in Debian: https://wiki.debian.org/VirtualBox notes that "A proprietary extra package enhances the base experience, adding things like RDP access to the Guest. "