Is Coldcard Really Open Source or Not?

Is Coldcard really open-source? I'm confused. I'm getting mixed messages about this. My definition of 'Open Source' for a a hardware wallet is: Can anyone download the code for free without permission and pay a software engineer or an AI to check for bugs?

Why did no-one spot the error in Coldcard's programing?

https://insider.btcpp.dev/p/when-randombytes-runs-but-doesnt

Was it that the code was locked up and unavailable for inspection

or was it available to inspect but no-one bothered?