The issue here is that if 99% of people use BlueSky and 1% use non-BlueSky AtProto servers, that leaves BlueSky with all the power to turn off federation. If BlueSky starts to do shady things, other instances can refuse and talk to each other instead - and eliminate 99% of your followers, 99% of the people you're following, etc.
Email is open, but if GMail decides to block all email from you, you're toast. And while GMail is large, their percentage of email inboxes pales in comparison to BlueSky's percentage of AtProto users (which is near 100% at the moment).
Yes, once things are federated, other folks start gaining some power over the protocol by virtue of usage. However, if 99% of people remain with BlueSky, everyone else essentially has no power.
mastodon.social has around 15% of the Fediverse on its server and it means that it has a lot of power. Mastodon (the software) is around 72% of the Fediverse which means that other ActivityPub software essentially has to use Mastodon-flavored ActivityPub with whatever quirks might exist in Mastodon. But that's still way less power than BlueSky has in the AtProto ecosystem.
Open protocols are only good as long as there's enough reason for lots of different parties to keep those lines of communication open. mastodon.social needs to keep supporting ActivityPub because they'd lose 85% of their network if they stopped. Let's say it's 2030 and AtProto has 500M users and 99% of them are using BlueSky. BlueSky could simply turn off all the AtProto endpoints and make their web and mobile apps use proprietary endpoints. I'm not saying they'd do that, but they certainly could. Now, if 2030 comes around and there are 500M AtProto users and 10% of them are on BlueSky, then it wouldn't really be possible for BlueSky to turn off AtProto. They'd lose 90% of their network.
But we don't know if AtProto will catch on outside of BlueSky or if BlueSky will remain the vast majority of the network. If there isn't a lot of use outside of BlueSky, there could come a day when it's very tempting to turn it off - or do something that isn't quite turning it off, but would effectively accomplish it. Maybe they just start making breaking changes to AtProto, rolling it out, and documenting the change a week later and third parties just end up unreliable and people migrate off them. There's lots of options.
Five years from now, how is BlueSky making money? Are they just storing, processing, and serving lots of content without good monetization as third party apps start grabbing users and making money off their servers? I mean, we saw what Reddit and Twitter did. If BlueSky controls 99% of AtProto users, they can turn the firehose off. Even if they aren't trying to be evil or maximize their revenue, at some point they need money for all those engineers and servers. Maybe the official BlueSky app will be popular enough for them to get some ad revenue there and not feel the need to go after third party apps. Maybe a lot of things.
But until BlueSky is a minority of AtProto users/posts/etc., it's still something they have a lot of power over - including the power to pivot BlueSky off AtProto and make BlueSky a proprietary network.