> I would argue that leading and controlling the organization that provides the world with the single most ubiquitous cybersecurity resource justifies what you characterized as a meager cost in reputational capital alone.

Someone in the original HN thread about funding wrote a post explaining how poorly run CVE org was and it had been like that for years. It had a giant backlog, ignored criticism, and moved very slowly.

Then the second it shutdown a volunteer organization was assembled overnight.

> Control of something like the CVE registry is essentially a geopolitical concern at this point

This is purely a reputational concern. Being on government networks doesn't make it instantly more trustworthy or safe. Just like everything regarding security it takes lots of people looking at it, people reporting issues, and an organization that deals with issues promptly.