Risk management reveals risks such as: "the vendor disappeared", "the vendor hacked us", "someone hacked us through the vendor", "the vendor is no longer provid

Risk management reveals risks such as: "the vendor disappeared", "the vendor hacked us", "someone hacked us through the vendor", "the vendor is no longer providing support". Those are all risks associated with using a vendor, regardless of whether or not you are paying for the software. If your business relies on it, it should manage those risks (insurance, escrow, business processes, paying for support, etc). The project disappearing/bankruptcy is only the easiest to point to.