I'll tell you a tale of what happened to us...
We decided to do a rewrite in CFML, from legacy .cfm code to modern CFC-based OOP/frameworks. We evaluated CF9 (in prerelease at the time) against Railo and decided to go with Railo (free, open source), but we also switched from Windows to Linux and IIS to Apache, and rewrote the system from the ground-up using ColdBox.
It took 3 years and was a very painful launch (performance issues, mostly).
Railo became Lucee and we switched with it. We started integrating another JVM language (b/c we were using it for other backend processes that CFML's HTTP-based request/response paradigm wasn't suited for).
Lucee decided to implement OSGi, which broke our polyglot system so we got stuck on an old version -- and we still have one app stuck on that version. Which means one app stuck on JDK 8 (while everything else now runs on JDK 20 and is about to move to JDK 21).
We built newer apps with FW/1 and then ultimately rewrote everything piecemeal in a hybrid CFML/other JVM language approach, which allowed us to do everything incrementally.
It's hard to put a price on the incremental rewrite, but we couldn't do a lot of what we do today on CFML of any flavor: we have deployable apps that are self-contained and run directly on the JVM and are just 23-45MB in size, and mostly run in just 512MB of RAM.
We still have one legacy app running Lucee 4.5 on CommandBox on JDK 8. We have to rewrite it in 2024 because JDK 8 will no longer be supported by the other JVM language we switched most code to.
TL;DR: Lucee proved a dead-end to us. It was free but the project doesn't really care about backward compatibility. ColdBox also proved a dead-end to us -- but only because we had very specific multi-tenant, SSL/non-SSL requirements that ColdBox 3 didn't satisfy, so we customized it and that made it harder to upgrade. In addition, our environment was unusual enough that we ran into thread safety bugs all over the place and, in patching those, also made it harder to upgrade. Most people's needs are met by ColdBox out-of-the-box and upgrading is fine for them.
If we'd been willing to pay for Adobe CF licenses, we'd have continued to upgrade and wouldn't have gotten stuck on an old CFML engine on an old JDK. Given that we migrated away from CFML, it's hard to analyze the costs (everything we use now is free, open source, and we can upgrade any component of it independently whenever we want).
Bottom line: CommandBox is a great choice, no matter what else you do. Get yourself upgraded to ACF 2023 -- if your company is willing to pay license fees and/or support, it's a no-brainer to move off the old CF version (and the old JDK). Don't switch to Lucee just because it's free: either pay Adobe license fees and support or use that money to rewrite to another JVM language (NOT Ruby! NOT Python!) -- rewriting to another JVM language lets you do it incrementally and spread the cost over years.