AI companies that decide on risk levels capture the commercial upside, while the public bears the consequences of security failures or misuse