Maybe in a small deployment, yes, but in bigger deployments the price is not the main point. If you need a specific software fix pushed through quickly, good luck if you have US made equipment. Even when (if) you succeed it is often fixed by Chinese or other Asian coders anyway. It is insanity.
So you don't have a specific product set or even example bug to point to? I've never had an issue getting critical security fixes out of Cisco or Arista or Aruba, and given the fact you've completely ignored my question with more vague insinuations I'll assume you're making it up as you go.