In my experience the “privacy and security” argument is a smokescreen.
The real reason is that it makes someone else responsible for zero-days occuring, for the security of the tool, and for fixing security problems in the tool’s code. With open source tools the responsibility shifts to your cybersecurity team to at least audit the code.
I don’t know about your workplace, but there’s no one qualified for that at my workplace.
A good analogy: If you build your house yourself, you’re responsible for it meeting local building codes. If you pay someone else to build it, you can still have the same problems, but it’s the builder’s responsibility.
I mean, Paypal is a bank that isn’t beholden to all the normal bank regulations and customer protection rules due to technicalities. They have been caught effectively seizing customer funds through locking accounts for questionable reasons before, and offer no reasonable way of recovering funds from locked accounts. Numerous stories of people operating online etsy (and similar) storefronts getting accounts locked for vague claims they were actively money laundering, with no means for appeal.
Anyone just now becoming aware of the paypal execs’ corruption hasn’t been paying attention.