“The shrinking capability gap between open and closed models implies that cyber defenders have a limited time to prepare before frontier cyber capabilities become accessible without the safeguards used by proprietary companies.”