Nothing says you have to accept outside contributions. Signal rewrites outside pull requests for this very reason.
Also hot damn, the AFPL license is super aggressive, makes AGPLv3 look downright business friendly: https://en.m.wikipedia.org/wiki/Aladdin_Free_Public_License