I can see how govt funding was needed to help bootstrap the CVE program before people saw the value of it.

But now that CVEs form the basis of a very lucrative ~$16b/year industry[0], wouldn't it make sense to let those companies take over?

Privatizing the Internet enabled much more innovation than if it had stayed govt-funded.

0: https://www.grandviewresearch.com/industry-analysis/security...