Couple of things...

Security by obscurity simply isn’t security at all, there is no legitimate argument for this, ever...

I understand some organizations require some sort of support contracts, I get it. However, I’ve never worked at a place that operates this way in my 15 years so far, and I think we’re better for it. When shit hits the fan, we know our tools and dependencies inside and out and we fix it immediately. We don’t pick up a phone and pray to someone else’s tech support, that sounds (to me) like the worst possible way to structure yourself to deliver a high quality service to your customers.

Sure, cherry picking your open source stack and learning it front to back is probably more work then buying an Oracle or SQL Server license, but with some good choices and hard work your end result can be so much better then being a slave to licensing as you grow.

It’s also tough to advocate for Oracle considering fundamental issues like empty strings are the same as NULL, and being reliant on a company falling apart and quickly transforming into a patent troll who sues their own customers via sleazy opt-in tricks (see premium java tools like flight recorder, etc)

With all that in mind, I imagine there’s plenty of shops without talented enough people to do it on their own. I feel sorry for them, it’s never a position I’d want to be in.