The cost comes from compliance, audits, paperwork. Trials, PoCs, etc.
You also need to prove security and a long term lifecycle for the solution. Those open source packages - are they being updated? Who validates patches? etc etc.
Those are moats, once you're able to deliver the above, you're set for a long time.
Good luck!