Mitigating Cyber Risk in the Age of Open-Weight LLMs: Policy Gaps and Technical Realities