In some ways, I do find this surprising. Yes, it's clear there are violations. The complete corresponding source code needs to be AGPLv3 and its source code needs to be provided.

However, the argument that the permission to use their online infrastructure with anything in any way derived from those sources does not follow from the license doesn't sound entirely wrong either, and also not something that, to me, obviously follows from the software license, or even entirely obviously *could* follow from it (although the more courts treat copyright licenses as contracts, the more possible this probably becomes).