we are reasonably safe.
like I said we never marketed as “we are WP without GB” really, but as an independent CMS that is a FORK OF WP (that is different than what WPE and similar companies do - they do not really communicate clearly that their WP is a clone/fork they maintain with differences from the original that you can download from wp.org).
Moreover, should Automattic attack CP, we are well into the constraint of GPL2 - having respected the license.
They could try to make things worse for us, yes. But they won’t because CP Initiative is a no profit org. So basically the only ones profiting from CP are the devs who make sites with it or develop plugins and themes for it (that is totally legal).
Moreover, should they try to block access to repos, we do have directory that is up and running.
That all means we could already be self-reliant, and that we are basically safe.
We decided to go from WP repos + directory integration to directory only in stages, taking our time to do so, because we are safe to do so and we can totally do that without causing problems with our users in doing so. We do not want a repeat of GB in WP5 debacle. It is wrong to force thing to go fats and throw a change upon the community when you totally have the time to do it smoothly and safely.
If a problem arises I know for a fact that the community is totally able to go the self-reliant route in a shorter time than the one I mention above because we already have the integration plugin and we have an idea of what it would take to deprecate WP repos if that makes sense. I am not scared by what Matt is doing (and yes, he is managing a company like a man-child throwing tantrums when he thinks his company is in danger of losing the upper hand)