As said, orcid is a "non-for-profit organisation", which is in a sense commercial company (it is not allowed to make benefice but still needs to pay salaries). It would be much more difficult to buy than a normal company though (but not impossible).
What is important is that the data collected is open, transparent, and non-proprietary. "ORCID is releasing the Public Data File under a CC0 1.0 Public Domain Dedication developed by Creative Commons." (https://support.orcid.org/hc/en-us/articles/360006897394-How-do-I-get-the-public-data-file-
Since the data is portable, there is no risk of being locked in the system.