Is it possible for them to add additional code to the token as they
develop the rest of their infrastructure?
You can never change a deployed contract, but you can publish new contracts. This leaves two methods to add functionality to a contract after deploying it:
If you program your first contract to call functions in a second contract, the owner of the first contract could be able to change the address to the second contract. In effect, the code that is run would be changed. This is of course only possible if the original contract explicitly allowed for this, and was set up to do this.
Another way to change the token functionality is to simply deploy a new token contract with the same name. Then you can urge everyone to switch over to the new contract. This can be done without loss of funds, because you can copy all the balances over from the old contract to the new contract. This would not be completely painless or smooth.
I don't see how they can know how to build the token without first having the server code.
Most of the time, it's not that difficult to foresee what functionality a smart contract will need. It doesn't have to do all that much because the vast majority of the processing is done off-chain to save gas. You only really need the on-chain program to verify the important things such as ownership or payment.
Also, if their token code is not open source (which it isnt) why do
investors trust them enough to invest millions?
They either trust the developers or their company, or they are unaware of any technical details of Ethereum DApps and just completely oblivious. I personally don't send anything of value to a contract if I can't see the source code.
