Reading this like I'd read something from my CEO:
> No, they don't. This is just made up. Developers develop with open source software. They do not spend 2/3 of their time "adapting" it.
Many of our devs jam few-line functions into Spring Boot / JPA / Hibernate / Flask / FastAPI / Django /Some other framework, updating these frameworks, configuring these frameworks. We have a few admins poking configs at PostgreSQL or other OSS solutions. It's not that wrong to call it like that.
> This persons does not understand what python or curl are. They do not "go down". This is just someone not having a single clue what they are talking about.
If you don't build, fix and maintain the software on your own, US embargoes can take down any SaaS solution, and cut you off of binary distribution (I know a guy who couldn't install binaries on an IP that was flagged as russian), source distribution (people getting banned from GH), patches, ...
It does not go down in the traditional sense, but if you have no devs of something in the EU, you can easily get cut off of security updates and get exploited with known problems from a hostile side. If you have your own devs in there it's at least less clear who cuts of whom and who keeps what security problems around in the libraries for whose benefit.
All in all, this reads like a managers take on stuff, but then again, 20M is on the level of pennies at that scale and overall an orientation to OSS and open standards is a good thing imo.