The GPL doesn’t really stop bundlers from stealing it. It just requires them to provide the (potentially modified) source code to their customers upon request.

Yeah, it's also really important to understand that they only have to give source code to their customers. They don't have to provide source code upstream. So it's completely legitimate to take a GPL piece of software, make modifications, sell it anywhere you want, put a conspicuous note that you will supply source code on demand to your customers, and then never, ever supply source code because none of the users are technical enough to want the source code.

This is part of software freedom. Your end users do not have to distribute binaries or code to anyone that they don't want to. It's just that if they distribute a binary or code to someone, they have to grant the same freedoms they received.

Sometimes it's a bit hard to grasp these nuances (especially the, "Hey they can sell my software" bit). It's important to understand that before you choose a license.

You can still buy the software, request the source and upstream it yourself though, no?

You can, but they don't have to sell it to you. It would be a weird situation, though.

Code isn't protected from becoming proprietary SaaS with the GPL though, AGPLv3 is the only way to ensure those that take your code, modify it and offer it as SaaS publish the altered code.

Yes, and that's also an increasingly important point, given e.g. AWS's use of Redis.

A door lock doesn't actually stop a determined burglar either, but you'd still be a fool not to install a lock in your front door.

Is it GPL v2 or v3?