Re: NOW, we're in the third phase...
Indeed so.
Potentially, Risc-V is its own worst enemy. What it has shown is that, without too much effort, it is possible to define an ISA, get chips made, build a GCC or CLANG for it, and roll all of OSS out on it. If a company really, really wants to gain a market advantage and they're big enough to do it (Google, Alibaba, etc), then they can go fully bespoke with their own CPU, their own closed source compiler, borrow whatever they want from the entirety of OSS, and have a closed, heavily tailored ecosystem.
If they're a private datacentre / web services outfit like Google (i.e. it's only their software running on their computers [I'm ignoring Google's public cloud in this example]), they are not distirbuting software to anyone as such and so can do such things whilst keeping it all in-house.
So for Risc-V, it's openness is a double edged sword. Yes, it's avialable to all to "take on the mighty encumbents" as they wish. But at the same time, it's not so hard to take Risc-V in one's own direction ignoring everyone else and own the entirety of the end result.
This is perhaps why ARM will succeed; their control over what the ISA actually is is a benefit to those device manufacturers who simply want to make devices and sell them to system builders (those who aren't big enough to be able to mint their own chips and compilers). There's not so many system builders who can mint their own chips and compilers, there's a large sea of system builders who need to pick and choose from across the industry. Risc-V's uncontrolled diversity creates an environment where it could actually be annoyingly tricky for such system builders, whereas the more controlled ARM ecosystem makes life a little bit easier.