Why isn't there a thriving ecosystem of small-business security tools built on capable open models?

Reading the GLM-5.3 release, the vulnerability discovery numbers caught my eye. Open-source SOTA on CyberGym, gains that keep climbing the further you go up the exploitation chain, real CVEs found in