I myself have written a small llm proxy in Go, doing nothing but injecting the real API key to outgoing requests while itself validating virtual keys it generates, and it works great.

Risk is ensuring enough security researchers are finding these and quarantining these before that default cooldown lapses.

I’m unsure how to automate this properly, maybe an LLM is the best starting point.

Also if you don't like companies fixing vulns without releasing the open source first, you're going to be upset when you learn how every major vuln and associated patches are distributed long before the fixes hit the repos. A timely example of this is PHP, literally today.