Or to avoid legal uncertainty. The bigger the company, the more willing they are to pay $1000 a year to not have to track a potential risk, no matter how small that risk is. And another $1000 for paying by invoice, so the accounting department is happy.
They are relying on holding security fixes hostage.
That is scary..
It may also be a way to make financially supporting a project easier for users in corp environments -- it can be easier to get an expense through for a $1k software license than a $100 donation to an open source project or individual author.
> If your company is creating a closed source OAuth provider, it is strongly suggested that your company purchasing a commercial license.
And the text in the LICENSE file is a bog-standard BSD license, which doesn't say anything about not being able to use it for commercial purposes.
So it looks like they're relying on companies paying for support, or out of goodwill (or confusion), rather than because of any legal obligation.