I have a friend working at a company that is having “very important” discussions about this. They need to keep up with security patches (for obvious reasons) but the six month limit has them scared. The consensus seems to be that they don’t believe they can keep up with an upgrade schedule that fast and are thus forced to pay for support from someone or hope that the community backports security fixes far enough for…
What's being missed here is there is a whole slew of vendors that support openjdk. Those patches will come from red hat, ibm, azul,.. as well.
The community will provide updates, but it this point no one knows what the eventual pattern will be which makes planning based on it difficult.