Comment by shawnz

Most of the modules replace modules which Elastic provides, but not in the free distribution. For example, alerting, SAML auth/SSO, field and document filtering by user/role, etc.

However note that the most substantial module, the authentication module, is actually a fork of another product called Search Guard.

The differentiating factor in my case is simply the price. I think Elastic's X-pack modules actually provide a more complete overall experience, it's just not worth the cost. The Open Distro modules provide me with a budget alternative.