It's on the commercial user. Basically if you don't pay for support you're liable for the issues, at least in my only experience: a company I worked for decided

It's on the commercial user. Basically if you don't pay for support you're liable for the issues, at least in my only experience: a company I worked for decided to stop paying for Atos/Bullion support because of how shitty/useless it was, and the only reason the CEO agreed was that we could instead use Redhat software and support to take on part of the liability.