> if you're buying a Java app from a third party supplier and they say that they will only support their own product running on Oracle Java
Pretty much this.
$BigPublicSectorCompany I work for currently has a big web portal what does all their HR/Payroll/Finance/Procurement and which contractually requires Oracle Java.
Not just *any* random copy of Oracle Java either; but a specific flavour: JRE8.
The last available "free to use" version of that particular blend of buffoonery (8u201/8u202) went out of support in April 2019.
Obviously, since the allocated software budget is less than the list price of a second class postage stamp; we're STILL on the free version.
And we have to ignore it every single time any vulnerability reports are run or pentests get performed (that's a "known issue", mister auditor).
Whilst there are APPARENTLY efforts in place to replace the entire steaming pile of sewage... it's a Public Sector company.
So the smart money's on our data center getting swallowed by the sun first.
Sadly none of the attempts by the The-Techies-That-Be over the years to change this state of affairs have met with any success (so sayeth the PHBs: "it's a regional system, our hands are tied")
Eventually last year our own BOFH took matters into their own hands and sprang a series of "software tests" on our Beancounter and Inhuman Resources user's PCs; resulting in them all being moved across onto a combination of IcedTeaWeb plus Amazon Corretto 8 (which works with the portal just fine, is free-as-in-beer, and is at least a few gnatwings more secure than the old Oracle offering)... leaving just one single device with the previous strain installed locked in a cupboard for whenever the portal vendor inevitably points the finger at our "unsupported client setup" as a scapegoat for their server-side 404s and vulnerable Log4j-laden DLLs.
The users themselves noted briefly that their app splash screen logo had changed slightly; and otherwise went on with their regular business of not meeting the needs of the general public.
A surprising lack of defenestration was required.