When I worked in finance, compliance (the team, not the concept) strongly preferred us to use vendor-supported tech. The understanding I got was that using ven

When I worked in finance, compliance (the team, not the concept) strongly preferred us to use vendor-supported tech. The understanding I got was that using vendor-supported software would indemnify us if a bug in that software caused us to violate some regulation. Basically, violations caused by software could be passed off to the maintainer of that software, but for open source stuff we were considered the maintainer. It was generally worth it to them to pay for stuff to avoid the tail risk of upsetting the SEC.