Okay, so we’ve established that the cost of the endeavor is low.
> it’s the global catalog that helps everyone organize and talk about vulnerabilities
I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone.
> this is the follow up question to every headline and won't be seen as controversial later, so why bother treating it as controversial to say now
It’s not controversial, just a bit aloof.
Control of something like the CVE registry is essentially a geopolitical concern at this point, i.e. there has been anxiety brewing about China’s vulnerability disclosure laws for a bit now, much of which is warranted as China has been preventing the disclosure of vulnerabilities and instead stockpiling 0days and leveling up their APT groups. Even if the US wouldn’t exert such blatant influence or control over the program, the fact that vulnerability disclosures are being sent to US entities, or even just traveling through IP space we control, may be alone enough for value to be extracted.
This pattern could basically be viewed as the DOGE fallacy at this point.