Risk mitigation jobs tend to be B.S., unless that risk mitigation is your company’s reason for living, e.g. a security and/or insurance company.

The job of both HR and security is to look like they are providing a service, but while foremost supporting the business.

They can’t stop because they won’t stop.

It's not that they think it's a potential problem, it's that they want to persuade the public and politicians to believe it's a potential problem in order to secure government funding ("we have to win the AI race with China!") and/or favorable legislation ("uncensored open weight models are too dangerous!").