CentOS was a binary/functionally compatible build of RHEL without the RHEL branding.
>IBM effectively cut off CentOS.
Red Hat (not IBM) made the decision to end CentOS Linux and move their focus toward CentOS Stream.
>Rocky Linux is the replacement free RHEL-compatible distro...
Rocky Linux is one of many choices for a RHEL-compatible distribution. I would also say CentOS Stream is also a viable choice. It works well from my own personal experience.
>but is higher effort to maintain than CentOS was.
Speaking as the lead of Release Engineering, it does require quite a bit of effort to maintain Rocky Linux. It can be especially time consuming during May and November when releases are scheduled, given that it's volunteer time.
As for CIQ, who knows what they offer or what it is they are actually doing with our distribution. Is it to check a box? Probably, given the way I've seen some companies act around these sorts of things. Does it offer security improvements? Who really even knows.