RedHat makes, for example, patches for kernel vulnerabilities, but they actually give that away for free. What they sell is a promise that when there's a new vulnerability, you can get a patch from them quickly.
They also spread this service across MANY different open source packages. Like you said, a company that just offered services around a smaller package would have to run a lot more lean and would probably be a risky venture.
What's preventing someone from freeloading? It sounds like regardless of whether you're paying, you can still get the patches.
It's much harder for freeloaders to accept feature requests from customers, for example, because that would result in a fork.
What's the joke where someone fixes some machine and charges $1000? Their cost breakdown was:
turning a knob: $1
knowing which knob to turn: $999
If you catch any bugs specific to your systems or need special feature Red Hat is always there to help because a lot of open source software developers are as well Red Hat employees.
If you use CentOS or whatever other RHEL-based distribution there is no support at all other the one community might provide.
That may be the case, but WorkMail is definitely not eating MSFT's lunch. Microsoft continues to be incredibly successful in enterprise
All the other big players like Google/Facebook will open source those middle pieces to help people who will make apps that will most likely have to interact with their platforms. They'll never release the source to actual end products.
Are there any examples where the middle-tier stuff is successful on its own as a business model? I guess you could say Redhat or Canonical, but even then they're developing a lot of commercial stuff around the core open source operating systems/distros .. things like Landscape. Also they got in early, years ago, and might be able to build a better foundation than more recent companies.