As long as they keep releasing sources of their own modifications -if they ever do any-, the rest is fair play.
Not all open source licenses are copyleft licenses (e.g., MIT very much isn’t), but at the very least copyleft licenses make it much harder to exploit open source code commercially without giving back in some way, whether that’s code, or cash for a commercial license.
Not perfect, by any means, but definitely an improvement over more permissive licenses.
I am aware of how much I’m starting to sound a bit like RMS in my old age.
In this case the provider would of course have to comply with the AGPL and release their modifications as you mention, but it's important to note that No FOSS license protects at all against, for example, just offering the code as a service. It's the exact reason why Mongodb changed licenses and then a stream of commercial products started to change into "Source-Available" licenses in the recent past.