Exactly. We use them because they have a robust feature set that works for our use case (highly regulated data, etc). That's not a trivial thing. It's not a "moat" but it's wall.
- Compliance - Support - Security (not keeping things secure - offering custom security options. SAML, user roles, permissions, IP whitelisting, etc) - Customization
Building to support big complex customers is hard and if you get it right from a product and sales perspective, the inertia you can build is massive.