Perhaps the business case is for "we want the Open Source product, but we're in a compliance-oriented business and need to have someone selling us a support and maintenance contract behind it."

I'd suspect the moment you touch anything with external auditing, it looks better to say "we've got a fully paid up support contract from the vendor" than "we're running v1.23.456-ubuntu-patch-357-with-chives-and-salsa that we downloaded last week."