They get money from subscriptions and tokens, same as for closed-weight providers. Yes they'll lose some traffic to hosting services, but many users prefer to use the original training company since they have a guaranteed-correct implementation. Similar business model as open-source SaaS companies.

Some companies (most notably Deepseek) also manage to host their own LLMs so efficiently they undercut all third-party hosting services.

No one cares which company they use. They care about cost and does it act in a way they expect. Expecting anything else is pretty laughable and goes against human nature. You either create a moat so deep no one else can play or you have the government force users to use your products.