I get the feeling you are talking about Elastic here, and I 100% agree that core authentication and security features (and sane defaults) being "Enterprise" is a bonkers decision.
Free for some to use under certain restrictions. Therefore not Open Source (which is totally OK, I just want to make sure there's no confusion).