The vendor will absolutely take that custom code and use it to extract maximum profit from a different customer. I’ve experienced it from both sides of the transaction. Open source at least allows the functionality to be “developed” only once.

It doesn’t even have to be offshore accounts. Just a fat long-term maintenance contract would be enough to hide a lot of corrupt costs.