Companies who care about whether their FIPS implementation is validated or not would probably prefer buying from a company who sells it over relying on a guy at their company to get cmake back on track regularly. At that point, it's not just about the module, it's about custody, liability, etc.

It isn't just compiling something that works. You need to compile it exactly as specified. And document the entire process so you can prove to an auditor that you did everything correctly. Oh, and there's a list of tested platforms, and if your platform isn't on there, which Debian probably isn't, you need to explain to the auditor why it's ok, and why it isn't reasonable for you to use one of the platforms it was tested on.

What you are paying for is not saving the time of a developer compiling something. It's reducing the friction when you go through an audit.