Source-available isn’t the same as free and open-source. You might not be able to distribute or modify as you like to the former and may have any sort of license provisioned with further restrictions.

I’m sure it would persist even after an event of malicious activity. It may just turn out like email with servers needing to be added to an allowlist at worst and more moderation. I think scalability might be the limiting factor at some point though and as a result we could end up with several disconnected islands of server clusters instead of globally meshed servers.