they probably just stole all private codebases cursor ever saw. That + the ARR more than justifies the valuation even without any internal model.