It’s acceptable in this context because there isn’t a good alternative. You either make the code and data available and lose all commercial value, or you publish a redacted paper and lose scientific value.

I suspect the best solution is reform of the patent system that allows a trusted third party to verify research outcomes that are registered. E.g. the code and data are available to the patent office only for verification of the results.

In terms of the rest of academia, non-open results are acceptable because those in power (institutions, journals) don’t care.