Well if it's GPL without CLA and they accept outside contributions, they can't relicense / make it propriatary. Unlike with MIT.
The GPL (and even the AGPL) doesn't require you to make your modified source code publicly available (Debian explicitly considers licenses with this requirement non-free). The GPL only states you need to provide your customers with source code.