To clarify - RISC-V is an architecture, and that is an open specification. However, as an architecture it only specifies things like, what the instructions are and their encodings. It doesn't actually give you a CPU that does anything, just an abstraction of how to describe a CPU to a common standard.

Anyone is permitted to implement a RISC-V CPU, which would then involve coding something up in an RTL. The resulting RTL artifact may be open or closed source depending upon the developer's preference. In the case of the Vexriscv, that particular one implementation is MIT licensed. There are other implementations that also have MIT licenses, but because it is up to the core's implementer to pick a license, not all RISC-V cores are open source.

In fact, some of the most commercially successful RISC-V cores are closed source licensed.