1) the government is currently doing the work and the work is critical. Yoinking the system without any replacement causes catastrophic consequences that reduce profits (and maybe get a few folks killed, but really, think of the bottom line.) Anyways, if you want to transition a critical component you do so with a plan.

2) It is critically necessary for the CVE system to be trusted by many entities worldwide. The government has historically not played favorites and had that trust. This is still mostly true. No for-profit commercial entity has that same level of trust; the for-profit model removes the ability for that trust to truly be universal.