I think the theory is that it’s not purely static - you need to keep training and tuning the model (even just for general knowledge upkeep with current architecture) and so the infra/data is a contributory moat. Exfiltrating weights would get you a depreciating asset (plus we have all the lovely legal and regulatory frameworks to further protect them, which IS more like publishing)