When every day matters to profitability, I'm really surprised providers do voluntary cyber security testing or government approval in the critical path.

To be honest, if I were an LLM provider I would be wiring up my release process to be fully automated so within 10 mins of the last bit of fine-tuning it got released and a blog post posted.