There within lies the problem with the argument. ISS contains more than just HTTP/s serving.
As far as enterprise implementation, the reason why bank, large companies, etc use ISS or something similar is that they can sue the crap out Microsoft if the system is compromised. In every large company/organization I have ever worked for, I have asked why they used commercial products such as ISS over open source and the answer has always been “to have somebody to hold liable when it all goes down.”