The way it works is:

1) Business has a crappy, very manual website/intranet/whatever.

2) Someone with the actual capability to do something (CIO, manager, whatever) decides this has to change.

3) Input is asked from people from the business and people that are nominally technical. Usually the people that actually know the requirements or are going to maintain the new system are not included.

4) Other people from security, audits, etc. chime in

5) Someone (business analyst or project manager) transforms the laundry list of requirements into an RFP.

6) Business approves the RFP. It is sent out.

There are companies out there that live on RFPs. If you're lucky, they'll use open source software, but they might re-package that into their own CMS.

Companies that have the CMS that ticks the most boxes in the laundry list have a leg up. It doesn't matter if it's shitty and buggy, it's VERY hard to write "non-buggy" in an RFP (if the company is wise, they'll have a trial period with competing products, but that costs $$$).

So, the company ends up with proposals in the hundreds of thousands of dollars for what could have been an in-house project (be warned, a mismanaged one can run in the hundreds of thousands too, even with open source CMSs).

A period of time later, company will select the CMS and will drop that info on the team that will actually implement and maintain the buggy piece of crap (or even a decent product, if you're lucky).

(1) https://en.wikipedia.org/wiki/Request_for_proposal

See also:

https://doubleyourfreelancing.com/3-things-freelancers-know-...

   - No one gets fired for buying IBM
   - The issues around compliance/security/support are/should be sorted as part of the contract
   - OS projects don't invite managers for lunch
   - You need to factor in the price of support if you run OS projects. You will probably need few devs and sysadmins to run an enterprise-level solution
   - Documentation/training/videos for end-users

- OS won't offer you a fuctitious consulting job if your current employer gives you a sack

- OS won't fill your non existent swiss bank account

Quid pro quo.

I'm not talking money pre se, although I'm sure most enterprise software sales involve the CEO's "second cousin" getting a few dollars. A few games of bikini golf in the Bahamas can get a Fortune 500 company to standardize on the worst version control software in the world, or make using "cron" a firing offence.

Just take Drupal as an example, it is used ALOT, but isn't really pretty to look at codewise, also it has had its share of vulnerabilities, which are very easy to find, partly because all source code is readily available.

I suppose it does vary by project though.

A proprietary CMS may very well be holed like a swiss cheese, but it will not be as obvious / easy to find the holes when you can't look at the source code, you are basically left with fuzzers and manual/bruteforcing injection as your only viably point of entry.