You misunderstand how licensing works. They can build an entirely closed source OS around the Linux kernel if they want. The only thing they'd have to publish is the changes to the kernel itself. I don't see why they'd need to modify the kernel so they'd have to publish absolutely nothing!

But to answer your question, umbrelOS is debian. You're right that they don't advertise that fact anywhere (that I've seen). They use rugpi to build a preconfigured image that includes their changes and their software. All the details are indeed public and open, if you know what you're looking for:

https://github.com/getumbrel/umbrel/tree/master/packages/os

Ah there we go! Thanks!

That also answers the questions some other commenters have had elsewhere in this thread, about what happens to the hardware if the company fails. Now we know: it's Debian. Apt will remain.