I think this has historically been true and is still approximately true now. But I think in the relatively near future (less than 5 years) there's a really good chance it won't be true anymore.

Once open models catch up to the current frontier in vulnerability exploitation, the cost to target people will go way down. In the past, the cost to hack a random individual person was generally high enough that if there wasn't some special reason to hack you in particular, it wasn't worth it. That may no longer be the case in the near future. The floor of what is acceptable security for the General Public probably needs to rise quite a bit over the next few years.

Why would you assume Google, Apple, and defense-oriented agencies like CISA wouldn't also have access to those same models, but using them to fix issues?

Its just raising the bar across the board, I don't see how only attackers would benefit.