I don't have direct experience of this, but the general accusation I see is that companies hire Oracle to set up their systems, and Oracle's own people swear on a stack of bibles that the setup is in compliance, but behind the scenes they'll have enabled things that require more expensive licenses, and which Oracle knows are enabled and knows they can come back to shake you down for (sorry, "audit") later on.