> They don't actually prevent people from finding vulnerabilities; it just slows people in finding them because they have to use less capable models,

That's the point. Slowing people down. Hackers aren't "not people".

> You can't ever get rid of the arms race between defender and attacker.

Yes you can, and by doing exactly what you're complaining about:

   And if you do want that access, you have to verify your identity, and do a bunch of other things

That's the thing which gives defenders an advantage. A 3-month advantage, or could have been if the US government hadn't blocked it for a non-trivial fraction of the gap.