> significantly increase the amount of work you need to do if you want ISO 27001 or similar cert

Not true in my experience. We used a lot of "open source" software at work but that didn't matter in the certification. Maybe it depends on the auditor.