> is there any at all risk from a security standpoint where redhat owns the tooling for many devops customers?

They open source a lot of their tools, so I don't really think there's any lock-in (I assume that is what you meant by "insecurity" in them owning the tools, and not traditional computer security)