They host the blockchain. If they do not agree with the open source code, then they don’t deploy it and a fork needs to happen. There is no obligation for a witness to update to the most recent code base, but obviously that may reflect poorly on them and their reputation, ergo also income.

The witnesses have pretty much the power of the middle finger, ALAS complete control. If large stake holders, without vote, disagree the large stakeholders will need to find other witnesses and fork. Obviously, vests play a role in DPOS as well, thus witnesses better make sure to also consider large stakeholders. But in the end, they host the blockchain and they decide whether changes are adopted and rolled out [on their servers].

Since recently the creation of a new Genesis block is possible, thus the Steem blockchain can be fully forked, with or without approval of witnesses.