Packaged software is pretty much extinct. Everything is web applications. In this particular case, the billing network provider got hacked and ransomed by the same actors that attacked Caesars and MGM Resorts. The FBI should have destroyed that hacker outfit by now.
Just because the snail mail delivery system is pretty much gone that doesn’t preclude the software (i.e, ‘apps’) being developed separately from the distributor. The distributor subcontracts out development. Then sticks his name on it and just sells it through his server.