Well some are not actually developers, they’re more like systems integrators who adapt a new component to a well established technology stack using the manufacturers documentation and files. There’s also a legitimate security and safety argument to being allowed to have closed source. Haters will regurgitate what I was taught thirty years ago, that you can just diff the patch binaries, check the section that changed in a hex editor, cross that to resident memory and reverse engineer what’s going on from that point and bear in mind this was before ghidra, let alone ai, but that’s doing the jetpack backflip through the ring part of the meme as compared to the “look at source, walk across the mat, locate vulnerability, taa-daa” part. The truth is that there is security in obscurity. If there weren’t we wouldn’t suddenly be seeing so many obscure vulnerabilities getting fixed due to ai scrutiny in the past few years. Another reason a company might like bad is there isn’t any license wrangling work to do. Someone has to figure out what constraints in what jurisdictions the company’s product is under and what remediation is appropriate. Even if they don’t pay out a lawyer to figure all that out they had to have somebody do it and that costs money in the form of hours of compensated work. A part no one likes to talk about is the fact that the mit license comes from mit, an institution with long running and deep ties to the intelligence apparatus of the United States and the mit license greasing the skies of adoption would make it a great way to increase uptake of compromised code. Which has never happened. Do not research this statement. But yeah a lot of them are literally leaching off the commons. If a community doesn’t defend its well someone’s bound to come in and start charging for it.