There's a GNU General Public License which allows some scripts to be put into the public domain for use by anyone for free. Some have clauses that they want their copyright information left in it so people know who the original author was.
When it comes to FREE, there's all sorts of Free
There are the free scripts that are actually just code snipits, there's entire programs which you can view the source and they're 100% free to modify and tweak as you need, and then there are free scripts that are closed source.
Generally people these days release some free scripts with IonCode encrypted source. This allows the original owner to be the only one who can modify code. Many web developers will release things in this method as it means if the customer needs something changed, they have to come back to the original designer/programmer for a custom modification job.
FLASH is very similar in this way where designers give the final product, but they don't give the source file - but I digress.
So you have 5 main ways programs are built;
1) FREE - viewable source
2) FREE - closed source
3) PAID - partial source
4) PAID - full source
5) PAID - Closed source
You then have scripts and additional programs that plug into it which can be closed or open also.
WHMCS - a closed source program, but ability to edit templates.
Some of the modules are closed soruce, some are open source.
The risk for the closed source option is TRUST. You have to trust who made the program and that they didn't put any backdoors in the script or that they're sending information back to a 3rd party. This is one of the big arguments on forums where people want to buy a module, but the programmer closes the source, won't let anyone view it, and then after a year or two, they disapear and you're left with a program that you paid good money for, but now can't do anything with.
WHMCS has a nice little extra they do for people in that if someone makes an add-on, and they want to close the source (after all, they worked hard on making the program) - then the staff at WHMCS will go through the code, VET the code, and assure users that it's on the "Up and Up".
There's a TON of different control panels on the market these days, but when it comes to hosting, cPanel and Plesk are probably the two leaders in the pack due to the stability and amount of support available in forums etc. DirectAdmin and some others come in a very close second.
For us, our shared hosting has been cPanel for over 10 years as our customers like the ease of use and functions. On dedicated servers or VPS users get to choose whatever they want to install, but we would only support cPanel if they had questions. It goes to familiarity of the product. We know it inside and out and can answer questions in seconds or minutes because we use the software daily ourselves.