They can only hit a JSON endpoint in the same DNS zone (eTLD+1) as the sender's email, e.g. if the email is from sender@mail.example.com, it can only hit endpoints on example.com and its subdomains.
Open in what sense? For example, there's no open standard (to the best of my knowledge) for the HTML used in emails right now and different email clients render HTML in emails differently.
On the other hand, the protocol itself is standardized, but AMP is not working on protocol level.
Regardless of whether you like the keyboard or not (or have no opinion), I strongly recommend you check out their blog: https://ultimatehackingkeyboard.com/blog
They gave a very thorough overview of the (many, many) challenges involved with "kickstarting" a hardware product - and how they overcame them (from issues with banks to FFC and CE certification). It's a great source of knowledge for anyone who considers doing the same.
reply