That is a good point to be aware of, but
1) downloading and installing Tianocore on bare metal and/or VMs fully complies with the additional restriction stated in the UEFI FAT license, and
2) virtually all firmware in use today use non-open components
I am not familiar with the whole Debian build infrastructure. So if I missed the point where this becomes a real issue, hope you can elaborate.
Ronald