>RedHat makes, for example, patches for kernel vulnerabilities, but they actually give that away for free. What they sell is a promise that when there's a new vulnerability, you can get a patch from them quickly.
What's preventing someone from freeloading? It sounds like regardless of whether you're paying, you can still get the patches.