The biggest friction comes from integration. Code from volunteer contributors rarely aligns with the architecture you already run. Adapting it means rewriting interfaces, mapping mismatched data formats, and reworking dependency trees. Each change risks breaking something else.
Performance gaps are next. Many open source models are trained for general cases, not your workload. You tune them yourself or accept degraded speed and accuracy. That means more compute costs, longer batch times, or laggy user-facing features.
Security is a hard edge. The source is open, but that also means exploits are open to all. Reviewing every dependency for vulnerabilities is tedious and never fully done. Popular libraries can get abandoned, leaving unpatched weaknesses in production.