A lot of the work is carried over model to model, so I think the most comparable product is a live service game. Always have to be building on the last thing, and if you stop you'll essentially lose the entirety of the initial investment because you won't keep anyone's attention. Plus a healthy dose of "winner-takes-most".
When every day matters to profitability, I'm really surprised providers do voluntary cyber security testing or government approval in the critical path.
To be honest, if I were an LLM provider I would be wiring up my release process to be fully automated so within 10 mins of the last bit of fine-tuning it got released and a blog post posted.