All of what you said is true, but I just want to add a note that I mentioned a support contract with open source developers, not necessarily the authors of the

All of what you said is true, but I just want to add a note that I mentioned a support contract with open source developers, not necessarily the authors of the open source software in question. It's like when a company buys a contract with an enterprise Linux distribution: the entity offering the contract didn't author the full stack (though I'd guess they have at least some kernel contributors on staff) but they can still support it in a way that keeps the compliance department of the buying company happy. Also, your kitchen knife set example is very relevant because, from personal experience, I know this happens but I also know problems (including accidents) resulting from using a personal knife set aren't attributed to the manufacturer of the knives but instead are treated exactly as if they happened using ones provided by the business that owns the kitchen.