UnPlugged had to open source their “anti virus” as their GitHub Readme (mirror) makes it clear they build on top of TrackerControl & DivestOS Hypatia, both of which are GPLv3. The fact that they didn’t means they violated the license for as long.
Probably the developers of both those FOSS projects to refer UnPlugged to sfconservancy.org.