But control of the protocol - the definition and development - is still controlled by the for-profit company, right? It hasn't been handed over to a nonprofit governance committee, has it?

Federation or not, if Bluesky dominates the protocol, they can decide to stop federating and essentially kill the independent servers. Much like what Signal did. Sure, you can run your own Signal server, but without access to the dominant player's market, and using a protocol that's controlled monopolistically, it's practically useless to do so - which is why almost nobody does it anymore.