But there needs to be investment to pay said security professionals to develop the tools, publish them, polish them to be user-friendly (otherwise no-one uses t

But there needs to be investment to pay said security professionals to develop the tools, publish them, polish them to be user-friendly (otherwise no-one uses them, see GPG), to pay for the datacenter hosting... It doesn't happen in a vacuum.