My recollection is that Fail2Ban has some default settings, but is mostly reactionary in terms of blacklisting things that it observes trying to get in. Crowdsec behaves in a similar vein but, as the name implies, includes a lot of crowdsourced rules and preventative measures.

It is 100% the support. Corporations pay big money to have experts on call to fix things fast when they break, and there’s basically no other player for that kind of model in the Linux space.