I fully agree that there are maintenance risks when you buy software, but imho, those risks are much much more easier to mitigate: buy only "mature" software, make sure that maintenance is governed by contract, know your path to reversibility, etc.

Ultimately, in my opinion, this “make or buy” issue goes back to the age-old debate about how companies choose to adapt to the processes already built into the software they purchase. The companies that will “make” are probably the ones that would have developed custom solutions at some point anyway.