Yes, very. I previously worked for RH and there really wasn't a top end of support options. I knew of companies with a contract that had RH maintaining custom kernel patched for them. Another paid for a highly skilled SRE to be in their office ready to help anytime. A small number of companies are willing to pay a lot of money for these kinds of options.

Long-term support is critical. For example, Microsoft excels in that area and has patched its really old products to meet new PCI recommendations such as TLS 1.3, which can actually save a lot of money.

Maybe not, but when your certification requires using supported OS and patching know exploits as soon as possible, then you don't have much distro options to choose from if you want easier time to pass an audit.

We've submitted bugs related to IO, and had them promptly fixed.