Can tell you what I know from a discussion with a SF developer a few years ago.
As you probably know, Jolla nearly went bust ~5 years ago. They realised they couldn’t compete with Apple & Google and so created a new business model around corporate clients. One of their unique selling points is that they they’re out of reach of the US Govt and so went touting for business amongst those major organisations that had reason to distrust US operating systems.
Fairly quickly, they landed a contract with Rostelecom, the biggest ISP in Russia. The latter give Aurora devices to their engineers. Consequently, Rostelecom wanted their own extensions and security built into Sailfish whilst not needing some of the consumer market stuff. There was possibly some ego involved as well as they wanted their own OS division and own OS (based on Sailfish).
Jolla didn’t mind because Russians being involved with development isn’t great for their image either.
So 3.1 and 3.2 brought encryption and improved VPN – two of the main security features Rostelcom wanted.
If you look at the unmaintained’s link, there’s no real difference between the two OSs.
A few years ago, Rostelecom was about 99% of their income (my estimate). They were looking at other big contracts but I don’t know if they landed any.