> I simply can not imagine even a whole fortune 500 company supporting their own business logic written on top of Spring, which includes log4j and a whole host of other open source dependencies.

> And what's the commercial alternative? I'm personally not aware of one.

There's commercial support for Spring:

https://spring.io/support https://tanzu.vmware.com/support/oss