Open-source isn’t a guarantee that whoever makes the open-source software is privacy-respecting. Android was made by Google for example, and it was made open-source for the express purpose of creating a mobile OS ecosystem that would become so dominant it would allow Google to collect data on as many people as possible. Google invested massive amounts of money developing an entire operating system for a reason: they didn’t do it out of kindness.

Conversely, closed source isn’t a guarantee that whoever makes the software is up to no good. There’s plenty of closed source software out there that’s perfectly legit. But of course it’s harder to verify the code if you have doubts.

when it comes to server-side software, FOSS is of little importance unless you are self hosting. there is zero way for you to verify, unlike client software.