I definitely learned that working with a law firm once. I could have set them up something more secure with an open source stack but what they really wanted was a company to blame if things weren’t as secure as I promised.

I imagine that’s why a lot of governments and big companies pick a big corporate vendor when it’d be cheaper and better to hire people. There’s less liability if you can blame a vendor than a specialist in the event something goes haywire.