Technically they are correct. None of the Open Source licenses really regulate what happens on the server. When it's not you running the binary, all the licenses are basically useless. AGPL is one of the few that address this a little bit, but even there you only get the source code itself, when the value in most online services is in the databases and backend stuff that you still don't get to access with AGPL.
The Free Software world hasn't figured out what to do with services running on computers you don't own. GDPR is so far the only thing does something about the server side, but that's EU law, not a license you can slap onto your software.
Technically they are correct. None of the Open Source licenses really regulate what happens on the server. When it's not you running the binary, all the licenses are basically useless. AGPL is one of the few that address this a little bit, but even there you only get the source code itself, when the value in most online services is in the databases and backend stuff that you still don't get to access with AGPL.
The Free Software world hasn't figured out what to do with services running on computers you don't own. GDPR is so far the only thing does something about the server side, but that's EU law, not a license you can slap onto your software.