If your product is sufficiently complex, you may have organizational expertise in running it that the cloud providers can't match, though I can't think of any examples of this. There security requirements like fips-validation and released STIGs that make organizations depend on your product. Off the top of my head, other than these, I can't think of anything RHEL offers that Amazon Linux doesn't, but plenty of orgs still choose the RHEL ami for their EC2s. Some orgs may want or be required to self-host. Some orgs may use your cloud but only in a FedRamp-accredited or classified enclave, where many managed services available in the commercial enclave are not available or not yet approved by your sponsoring agency.

I don't know how much of a moat this constitutes for vendors like Elastic, though. Those markets are inherently smaller than what they hoped to get out of managed Elastic cloud, and more labor-intensive to service. It's more of a moat for the big five defense contractors and why Raytheon is still writing all the software for spy satellites rather than Google and Lockheed does all the hardware rather than SpaceX. Of course, they're not open source, but the contracts usually specify the government owns your code, not you, and they can share it with any other contractor they choose if they want to replace you.

HashiCorp is the latest big name to do it—they switched to the BUSL, which more or less says you can only use the product if you aren't offering it for sale in competition with HashiCorp:

https://www.hashicorp.com/bsl