Then companies are on the hook for validating and and remediating internal builds of CVEs.

Michaelt is right and it is becoming a major source of revenue for open-core startups (eg. Chainguard)