They get money from subscriptions and tokens, same as for closed-weight providers. Yes they'll lose some traffic to hosting services, but many users prefer to use the original training company since they have a guaranteed-correct implementation. Similar business model as open-source SaaS companies.
Some companies (most notably Deepseek) also manage to host their own LLMs so efficiently they undercut all third-party hosting services.