I think, because Corp. In Corp, they want someone to be in charge, and take reponsible when something mess up. It is easy for IT to proposed to buy a solution, because the vendor take responsible for mess up, rather than use open-source and have to fix bug themselves.

There are also case where developer push malware into open-source.