That is not correct.
The JR does not cover that - there is no challenge to the Met deciding that policing is not for hire. (NB: that is not the same as those holding events defraying some of the cost of crowd control policing, though in those cases too it is the police who decide what presence is required).
If Harry needs protection in UK - and the current position is that every trip will be assessed and security provided in light of assessment - then he gets it. He doesn't need to pay for it (though if he wanted to, I'm sure he could). What he can't do is pay to skip the threat assessment and have blanket security.
The JR is looking at RAVEC (the key decision making committee) and deciding if it is competent - appropriate membership, appropriate information flow and working practices etc. What it is not doing is remaking an individual RAVEC decision.
If RAVEC is found unfit, then it will need to be fixed, and every decision done again under the new and suitable system. That does not mean any particular decision will be changed though, that will depend on individual circumstances and what the successor body assesses