Because the chance of someone auditing the actual source code is near zero, but for open source software it's near 100% that someone or, worse something aka an AI bot looking for a revenue stream, will have a look at your code. And EVEN IF you get caught stealing by whatever random incident (say, your code repository being 0wned) - it's a matter of a settlement payment. If you are not a company, but an individual person... well, just look at what happened to Aaron Swartz RIP.
And for the WINE/ReactOS/console homebrew folks, it's vital to be able to claim no code contributor ever got exposed, even indirectly, to proprietary code.