But there isn't any particular reason why a paid/proprietary host couldn't just as easily end up being taken over / sold to a party intending to inject malware. It happens all the time really.
As long as business is not going as well as owners want, the same economic problem exists in private software too - in fact, the private companies get acquired all the time too, and they get shut down, causing DOS for many of their clients.
(See for example: https://www.tumblr.com/ourincrediblejourney )
One difference is that closed-source source usually much less efficient; I cannot imagine "100K+" customers from a commercial org with just a single developer. And when there are dozens or hundreds of people involved, it's unlikely that new owners would turn to outright criminal activity like malware; they are much more likely to just shut down.
https://www.theverge.com/2024/5/1/24146205/lastpass-independ...
Why not?
Might as well ask why companies like money.
And no, the car industry has almost no competition. It's an oligopoly with very few players and a notoriously hard industry to get in.