So let me see .....
I could download, build and install MariaDB, for nothing; and get the complete Source Code, which I can subject to an independent security audit. If it doesn't quite suit my needs, I can employ any competent C programmer to fix it.
..... Or I could spend a lot of money on a pre-compiled Microsoft SQL Server, not get the Source Code, have to trust them without a security audit, and if it doesn't quite suit my needs, I'd better change my needs.
Hmm, tough decision!