The CSI interface is open source, the image processing hardware to take the data and turn it into actual images is not - it's run by a proprietary undocumented blob on a proprietary undocumented core. So you can interface to whatever camera you like, you just can't use it as a camera. Even that part wasn't open source until well over year after they added the DRM chip.
Every one of those afternarket cameras - the tiny ones, the big ones with replaceable lenses, the IR ones, the funny fisheye ones, all of them - works around this by using the same sensor as the official v1 camera and looking enough like it that the existing code will talk to it. This is precisely what the Raspberry Pi Foundation added the DRM chip to the v2 to stop people from doing. They can't do anything about the v1 clones, but they can stop anyone from doing the same with the better sensor in the v2 and they have.
(In theory the open source CSI driver is useful for non-camera hardware though - for example, there's one obscure third party board that uses this for HDMI capture. I think this may be the main intended purpose. It came too late to save the Kickstarter campaign a few years back promising such a board though.)