They sell their products using the credentials they gained.

I’d never heard of socket until they found and reported shai hulud hiding in pytorch lightning. It pays off.

What happens after a couple of players have obtained marketshare and the market has consolidated?

I think there are diminishing returns to be had.