While all three of your points are excellent concerns, I think you may be giving off-the-shelf systems a little too much credit.
The SIS systems I know (US, K-12) do a mediocre job of updating quickly to new technologies/requirements (#2) and do a terrible job of interoperating with other systems through APIs (#3).
Doubleplus agree. Have been working with a state department on a student registration system for the past few years, and now everything's going to be placed under one of the 'big commercial' players in this space. No interop specs have been delivered/offered, and the integration team seems wholly unaware of the complexities of the requirements laid out by the state for the types of processes we have to comply with. And talk about 'not adapting'? We have processes in our system relating to HR and the commercial team flat out said "we don't want to deal with that", but also balked at offering us any sort of integration service points (REST/SOAP/anything) to keep doing what we need to do next year.
I've never met a software vendor in this space that has a freaking clue what they're getting into when they sign these contracts. They never think about interoperability despite signing on to the requirements, they assume too much when it comes to their customers defining requirements, and hate offering up the goods to work with other systems you have in place (but can usually be twisted to offer bare minimum integration).
That's why I think you're better off with something you can sever ties with when it falls behind on #2 and use clear RFP and contract requirements + in-house dev talent to drive #3. The hardest to deal with is always going to be #3 because everyone always is trying to get you to use their whole architecture, even thought most of the time they suck at some or all of what they sell.
I think that #3 will also get a lot better with commercial software. The reality is that most of these guys have spent the last 5-10 years buying up competitors who built other systems their customers were interested in as an attempt to get all that business under one contract. Their efforts integrating software from acquisitions has been pathetic, at least in part because they haven't had a services-oriented architecture even though that's what really is called for. So I think this is a major area where we'll see changes in the next 5-10 years.
That being said, I think pretty much all off-the-shelf systems suck, but you're better off being able to hold someone else responsible for dev and sustainably meeting requirements and use in-house talent to hack around and problem solve so that users end up getting what they need fast.
You also want to chuck systems every few years and get something a lot better without having to pay the upfront costs of a rewrite like you would with a BYO-SIS.
And while I think this goes without saying, though these days I've seen districts screw this up, no matter how hosting is taken care of you need to own that data. You need nightly backups on servers you control and full access to your own information.
I'd add that your suggestion for #2 (migrate from one system to another every handful of years) has some pretty painful costs associated (PD/training, re-implementing customizations, data migration costs). At least when you've taken care to own your data/backups, this kind of migration is possible.
5-10 years is far too long to wait for system interoperability. My company (Clever - getclever.com) has bolted a read-only API onto a dozen of the top SIS systems today, would love to hear your thoughts (I'm dan@).
another good point. Our district has gone through five, count them five, commercial student information systems because the company has either gone bankrupt, been bought out by a larger vendor or depreciated. We just get our data converted, staff trained and somewhat comfortable and then the rug gets pulled out from under us again and we have to start over.
Anyone who think that commercial vendors are there to support education is dreaming. Commercial vendors are there for two reasons only - earnings per share and profitability.
The SIS systems I know (US, K-12) do a mediocre job of updating quickly to new technologies/requirements (#2) and do a terrible job of interoperating with other systems through APIs (#3).