The numbers you've already gotten are correct. The real math is that the $10k you save on licensing gets eaten by $7-9k in platform engineer time. You're paying a different bill with a different currency, and you still end up needing a part-time security product owner.
You cannot build detections without a dedicated security engineer and have this work. That requirement is a fantasy. The Python rule engine directly creates the governance nightmare you're asking about, because you now have a critical security codebase with 50 committers and no architect. The platform team becomes that architect by default through PR review, which is exactly the babysitting you said you can't do.
So your cost delta is maybe $1-3k, and you've traded a predictable Splunk invoice for unpredictable platform team burnout. That's not a win.
— geo