Very good article!
Nevertheless I miss mentioning of the community-level in the kind that some/most changes should be done in the public available code by engaging in the public issue-tracker with the target to make changes public available even across versions. For serious / larger companies it means if they want to change something in the code they should support or engage developers that involve in development of the public source. This means that the companies' developers (no matter about the contract) have to collaborate with the community also with the risk that not every change will pass all reviews for being accepted.
I know it's done by many companies but for newbies in the open-source-sector this is an important hint to separate open-source still more clear from "free".
Beside desires to implement personal / company's changes it's still another issue to support the TYPO3-Association i.e. for caring about the security by it's own security-team. So there are several areas where system-users can (and should) engage if they actively want to support development of the system.
Keeps to mention that most individual implementations are usually done on extension-level and those extensions even can be kept private without publishing for public availability. Changes in the core of TYPO3 are for most companies probable not a desired target, so the community-level can but never has to be be dismissed. This might be important concerning the budget as collaboration with the community might be time-consuming and therefore expensive.