To me, it sound like your auditor's objections are based on the availability of (commercial) support, and not the nature of the code's license or whether one can read or modify it.

There are entire vendors who specialize in selling open-source software with commercial support; Red Hat is the most famous example.