Someone has to pay the bills, so they need to earn some money. If you ain't paying you are the product is always a good metric, but in the email case the problem is also that a lot of the effort is manly IT admin rather than just the backend software.

You can roll your own dovecot and run your own emails at home in theory, in practice you need to be trusted by the major email providers to be able to send emails not tagged as malicious by anyone.

To protect their trusted status most providers collaborate on a lot of elements to be mutually sure they are not flooding each other with worthless spam. This is a lot of SPF, and other technical bullshit to be able to run a mail provider someone has to pay for

In case it is not clear: most use foss backend (dovecot or other), but this will not cover the whole software stack needed for an email provider

Posteo is mostly just a deployment of RoundCube.

Mind you, I do assume they have deployment scripts and code for handling payments and such, which aren't open-source.

I also have to say, though, a hosted service using open-source is *nice*, because they will hopeful contribute back to that, but it's not much beyond that.
You cannot know, whether they actually run the software that they publish in their repository, so auditing the open-source code hardly tells you anything about the trustworthiness of the actual service.

What does that even mean? Fastmail is mostly or entirely FOSS on the mail backend but the web front end is currently non-FOSS. You can of course use a FOSS client instead.

Hosted services are more about hosting than about the backend software anyway. You can use something like mailcow to self-host email if you don't mind headaches.

mxroute.com is probably all FOSS but they don't make an issue of it. Actually idk what web control panel they use now. It was formerly cpanel but they switched, probably for cost reasons. The webmail ui's are roundcube and a few others.

Not really much point. Email as a protocol isn't secure, so they can always use some software to read the messages in transit even if they secure them at rest. Many systems use Dovecot, Postfix, and other systems that have been open for ages. Only the UI is likely proprietary and that's mostly just for viewing and billing. And anything they're doing that's nefarious is likely a separate code base entirely since it doesn't need integration with the data in motion not being secure.

What are you looking to gain by understanding their code base?

Something like Disroot? Just about all the services they host are done with FOSS software. For email I think (?) they're using Nextcloud and RoundCube. In theory you could look for other providers that are using that software stack, there are paid service/hosting providers that provide Nextcloud hosting for example.

disroot maybe? afaik they're fully foss

The few I've seen were so small and new that I forgot about them. I remember one detail though, he was developing a jmap based email client and it's code was on GitHub. On the server side he was using Stalwart.

Migadu doesn't provide sources for their deployment, as far as I know, but most of the components they use are open and available on the usual places: https://github.com/migadu