That's such a bullshit claim. The entity that runs the servers where the data is stored always has a moat. They can aggressively rate limit scraping and simply refuse to provide dumps, and suddenly, they are the gatekeepers to everything that actually matters. Open source has nothing to do with this.
1. while they're still not quite there, the protocol is federated, so they aren't the only servers storing your data once that happens.
2. because stuff is signed to your account, and other PDSes replicate posts, even if your host got weird, you could recover a lot of it. if you want to be extra sure, you can run your own PDS as well. I am not super up to date with how much replication various "reach" services store the firehose permanently, but should be possible to get content from them, for example.
3. I agree that open source doesn't prevent this.
You can always erect walls around things. We at least try to poison pill it enough that if the company tried to, people would exit with the data first. Which is why internally we don't see us as having a strong moat around the data.
That's only true if other large servers eventually emerge. "Federated" systems have a tendency to coalesce into a network wherein a few big players – often just a single one – dominate the ecosystem. Gmail, Matrix.org, the few Mastodon and Lemmy servers that actually matter, etc. are examples of this.
Usually, this leads to the dominant servers dictating rules for everyone else under threat of defederation (already the status quo with Mastodon today). And at the end, you have a hyper-complicated federated system that operates the same way as the centralized systems it originally aimed to replace.
But Bluesky works a bit differently. Users don't work as like, "user@domain", you have the moral equivalent of a UUID. If the host of your PDS decides to defederate with someone else's host, that doesn't mean you're prevented from getting their posts, it just means that like, it's a bit harder to. And if you don't like what your PDS's host chooses with regards to defederation, you move to a different one, and when you do, you retain your entire following/follower graph, and people who follow you don't necessarily even notice..
The closest way to think about it is git, IMHO. GitHub hosts a copy of your project (a PDS of your posts), and you can have one locally too. You can also put up copies elsewhere, and people can grab copies of your project elsewhere. If GitHub decides to stop hosting your project, you can put it up on another host, no problem. If GitHub decides to stop hosting a project you want to follow, you can follow where they move.
This is in sharp contrast to email or Mastodon, though in my understanding, Mastodon has made it a bit easier to move servers lately.
Most criticism of BlueSky/AT tends to be that it's too hard to do things like private accounts, keeping your block/mutelist private, or even deleting posts. (Though the latter is better now thanks to the addition of the moral equivalent of git rebase.)
Federation only makes it easier for everyone to scrape the public data, which most contents of a social network of this kind is. And we all know that by delaying the Federation Bluesky is making sure they will be the most popular and most used instance by default because it makes discovery and easiest engagement.
Depends on what you mean by "engagement and discovery." If you mean, "How will people hear about AT, by BlueSky or by StevesPDS.com, then sure, BlueSky has a ton of attention. But if you mean "engagement with other people's posts" or "discovering other users", that's the same no matter where their content is hosted.
So, the situation isn't so bleak as you describe, but also, yeah, controlling the website or app called "Bluesky" is still a moat (until it's not!)