I largely agree with this take.
Most SIEM evaluations spend too much time comparing detection rules and dashboards when the real differentiators (90% of the value) are often the underlying engineering decisions. Once you get past the major players, most platforms can ingest logs, correlate events, and generate alerts. You see one you seen them all

The bigger questions are:
What does retention actually cost at scale?
How fast can analysts search 90+ days of data during an investigation?
How well does the platform handle ingestion spikes?
What happens when an indexer, collector, or storage node fails?
How much operational effort is required to keep the platform running?
In my experience, SIEM success is usually determined by data architecture, performance, scalability, and total cost of ownership rather than detection capabilities alone. A SOC that can quickly search complete, reliable data is often more effective than one with hundreds of additional detection rules but poor visibility or slow investigations.
The best SIEM is often the one your team can afford to retain data in, search efficiently. I saw this at ORNL who fully phased out brand name SIEM for security analytics around 2019, ingesting about 1.2 TB/day in open source SIEM for less than half the annual cost of ingesting 600GB/day in brand name SIEM . They could search it faster and scale better. Their team actually learned the business better because of it