It is vendor lock-in problem.
People think(and in a certain sense is might be true) that vendors providing custom implementations that integrate well with the rest of ecosystem save money and make it easy to manage things as one system where everything is integrated.
But...
The reality is that sooner or later exactly this is used to vendor lock-in people and companies, because nothing you use has any interoperability with any other system any longer, at least without severely compromising security or limiting functionality.
Then...
You are at the mercy of the vendor. And as long as the vendor can make it so that migration of switching to any other solution is impossible or a path of misery and switching is more expensive than paying the vendor, that vendor gets tolerated.
Well...
The repercussions are... something like what the author/OP already mentioned. Large breaches, slow fixes. CVE-s, yet sluggish reaction to them. Yet, you cannot just change gear, so instead of freely choosing other vendor, actually you don't really have a choice. So, you both continue to pay them and then pay in manhours and company reputation/data to restore systems after security breaches.
That's why....
I always try to use industry standards and secure implementations that are standards or de facto industry standards and tend to avoid "custom/nonstandard vendor implementations". Cisco in particular...like to create proprietary solutions and implementations.