What I'm saying is that they will have to be as soon as they accept an external contribution. The code they accept will be licensed under the AGPL by the contributor. A hosted-only version including both the contribution and hosted-only features would be a derived work, and thus require source disclosure under the terms of the AGPL.

(It is possible to keep stuff out of the "standard" distribution and only disclose when asked, but that seems like a whole lot of effort to maintain two identically licensed code bases.)