This is partly true. It’s worth noting that Canonical/Ubuntu has the same certifications such as DISA/STIG and FIPS, and runs quite a bit in highly sensitive environments, often bundled by ISVs, such as VMware or Pivotal, where I’ve worked.
Red Hat makes more money because they’re an enterprise software company and everyone thinks they’re just an OSS services company. They’re that too, but they are far more sophisticated than these articles claim.
At the core is that Red Hat’s distro is perceived as more of a standard by the ISV community that certified their software against it. Red Hat does a masterful job of playing both sides of openness - open copyright, closed trademark. They’re pure open source… but they fork most of the upstream with their own branded project version, and convince companies to certify against the proprietary trademarked offering. Automated upgrades and most documentation are behind a paywall. But they also have some of the best security responsiveness and extended support (up to 10 years?) in the industry to make up for it.
Beyond Linux, they also meet customers where they’re at by watching the competition and customers, and pivoting when they need to. Customers seem to like a competitors product more? They find the next leapfrog angle and invest years in it, dumping the old. OpenShift was rewritten 3 times before hitting paydirt! That’s good business sense. OpenShift trying to take on vSphere, Ceph evolving into an enterprise storage player, etc. These aren’t simple moves.
This dance of subtle open/closed aspects a great business model, and hard to replicate: open in code, but closed in the direction the money must flow. Most business folks don’t have the patience to weave this narrative, which takes years of reputation building. And it’s required alongside all the other “build a product people want” difficulty.
IBM also loves this model: “WebSphere” certification over “Java EE”, for example. Hence “OpenShift” certification over Kubernetes, or “RHEL” over Linux.