That statement is pretty stupid in general. But for server side software, open source doesn’t help much. Even if you can look at the source, you still need to trust them that that’s what they are running on their servers.

You give them the credentials for your Apple account. The security concept is “trust me bro” and that’s really the best they can do unless Apple helps them (which they have no reason to)

In a video from MKBHD they mentioned this problem and they said that the idea is basically that Apple will not block it because it will bring them bad PR and attention from regulators who are concerned with anti trust issues. Hard to predict what will actually happen but Apple just blocking 3rd party access and citing (legitimate) privacy and security concerns seems to be a likely outcome.

Apparently it was a problem when previous Tesla models released