These companies have no moat at all.
I think the staggering amounts of compute and capital at their disposal is a kind of moat.
The moat is the data they have collected. There is no way that the "de-identified" data from enterprise customers isn't making it into the training set one way or another.
Even worse, their "moat" depends on buying the most overpriced hardware in huge quantities and subsequently eat a huge amortization loss in a few years when it's obsolete.
I’m waiting for somebody to use one of the frontier models to hack its own data centre and exfiltrate everything…
Their moat is their research capability. It's a combination of proprietary internal technology and models and infrastructure, people, organizational structure, and culture. As long as they maintain the best and fastest research capability, they have a durable advantage, at least for the time being. If we start to saturate all economically useful outcomes that can be reached via greater research productivity attainable to us, then this moat will start to fall apart. It could also fall apart if safety issues force a premature halt or major slowdown to further research.