Cal.com is not a severely underfunded project, it raised around $32M of VC money.

It's not a "project" though; the business Cal.com Inc raised that VC money. Their open source repo did not raise the money.

Did they ever promise to keep their codebase FOSS forever, in a way that differs from what they're already doing over at cal.diy? If not, I don't see why it would be reasonable to expect them to spend a huge amount of money re-scanning on every single commit/deploy in order to keep their non-"DIY" product open source.