If OpenAI cared about open source or security, they'd give access to open source projects directly. But they don't:

https://openai.com/form/enterprise-trusted-access-for-cyber/

"Daybreak enables vetted enterprise customers and cybersecurity practitioners to use our most capable models for dual-use cybersecurity work."

They explicitly give out access to those who will make a big announcement of bugs found. OpenAI does not want projects to fix bugs themselves so it can have more bugs and better marketing.