Volunteer-run tech and IT for non-profits aren't exactly well known for the highest of standards of engineering. The likelihood of someone accidentally leaking AWS creds or other PII seems reasonably possible without well established engineering practices.
Alternatively, it may involve proprietary code for a software vendor they work with that they don't have the rights to redistribute.
I'd be really interested in contributing but I'd hate to be contributing and then find out that this non-profit is actually some rich persons tax avoidance scheme or can be pivoted in a way to make money for someone.
Having the source code licensed as GPL or something would make this a smaller concern for me.
It is easy enough to have a volunteering agreement that catches this with clauses. Open sourcing the code won’t help with that scenario anyway.
Security is security, how you get there is entirely up to your organization. Also I'm not sure how having code access to their site proves that it isn't some rich person's tax avoidance scheme. In a way, all charities allow rich people to avoid paying taxes to some degree.
Open source what, exactly? You point makes literally zero sense