I wonder how they vet any small companies? Just like stealing/selling Chrome/firefox extensions how will this work if a small company withe nextcloud offers mig

I wonder how they vet any small companies? Just like stealing/selling Chrome/firefox extensions how will this work if a small company withe nextcloud offers migration - then it is 'acquired' by 'evil' company. https://datatransferproject.dev/faq https://datatransferproject.dev/faq > Q: Why aren’t there more, smaller companies in the Project?