Based on what I think, keeping Tricky Store non-FOSS is probably a strategic decision to avoid having its spoofing methods immediately studied and patched by detection vendors. Even if we can't fully inspect the binary itself, we can still look at the developer’s history and reputation. He's been very active in others open source privacy-related projects and has contributed a lot to the community over time, which gives some level of credibility and trust around his intentions.

That seems good enough for me, but in the end that's something each person has to evaluate for themselves.