Low churn rates have been the cornerstone of enterprise SaaS. Once you signed an enterprise contract with Oracle, you weren't getting out of it anytime soon. A reader of this blog once sent me this adage,
Mainframes don't get replaced. They get shutdown when the company goes out of business or gets sold.
Times are changing. It's never been easier to create a SaaS company, and customers have more than realized the trade-offs of vendor lock-in.
Customers are increasingly pushing for data sovereignty. Data is valuable (or at least most companies believe theirs is). While data might not be on-premise and stored in the cloud, it should be stored in their cloud, not the vendor's. Data lock-in still exists for products like Snowflake, but for the applications that are built on top of the data warehouse, they have little data lock-in.
API-first products are easier to replace (technically). Mocking an API or providing an alternative implementation is something that most engineers can easily grok. What does a 1:1 replacement of Auth0 look like? Well, SSO and Authentication are somewhat defined problems (and APIs). What does a 1:1 replacement of Salesforce look like? Much harder to reason about.
Venture funding, cloud, open-source, and the ease of creating a SaaS have made it easier (and cheaper) than ever to create a company. This means more competition, more fast follows, and more choices for customers.
Of course there's a playbook to counteract some of these effects, and there will always be interesting new wedges that increase retention. Some that I think work well:
Generally, the deeper something is in the infrastructure stack, the harder it is to rip out.
Platforms and product suites have a larger API surface, and thus, more lock-in.
A common hypothesis is that the more products that your product integrates with, the stickier the lock-in. I don't think this is generally true (see Mulesoft, ETL providers, etc.).