There's also the strong likelihood of liability under the False Claims Act. Their contract terms with the US Government almost certainly require them to comply with NISPOM, including requirements that their key management personnel acquire and maintain security clearances and comply with all of its obligations. Elon's conduct is not compatible with those requirements, to put it mildly. Maybe there's some scenario where all SpaceX personnel are doing all their reporting and self-reporting of derogatory information as required, and maybe the government is issuing formal waivers, but the more likely situation is that they are willfully noncompliant despite claims to the US Government to the contrary.
Investors are buying all of this risk: the litigation risk with noncompliance with US Government NISPOM, the likelihood of losing their current and future contracts with the US Government, global criminal and civil liability for their production and distribution of CSAM and nonconsensual intimate images, their shaky business model across all of their lines of business, and all of it being led by an unhinged executive shackled to an increasingly unpopular political movement.