What's Qualcomm and Broadcom moat? Is it "just" IP or could they be replaced by a slower more expensive equivalent, say FPGA based, relying on open building blocks?

It’s a combination of IP and deep institutional expertise. The 5G standards plus other important protocol documentation, for example, are on the order of fifty thousand pages, built on decades of experience with edge/2g, 3g, and LTE. That’s just the documentation on the protocol, the real secret is in the mixed signal ICs that require custom cell libraries which Qualcomm/Broadcom work with fabs to develop for their own use. The only other company of note in this field is Apple which bought the initial IP from Intel (which bought it from Infineon, another IC manufacturer), so we’re talking about something so technically complex that only the deepest pockets and expertise can make any headway. When Apple bought Intel’s modem IP, over two thousand employees transferred with the deal, to give you an idea of the scale.

That’s just the radios, which is their bread and butter. A lot of their other products have similar barriers to entry.

As the sibling comment noted, FPGAs aren’t even in the running. Ignoring their power consumption, the biggest FPGAs only have a hundred thousand or so logic elements. While its not easy to map that to number of transistors per se, even a legacy nodes are capable of much more complex designs than you can fit on an cutting edge FPGA. This really makes a difference even at the lower end because you have to get the timing right between all the different parts of your logic, and making everything smaller gives a lot more room for error (its a lot easier to put delay lines than to reconfigure a section of your design to fit closer to another section).

The range of their offerings is immense and I think each product should be evaluated individually to competition. But just as an anecdote from my company - to create a full spectrum DOCSIS signal our HW team used multiple huge FPGA chips, I think it was Altera 10 or something (device is EOS by now) and that only for the DAC (kinda), there were separate CPU, separate 10G switch, separate utility FPGA, separate memory, separate everything. And it had to be glued together with some insane mash of code on top of the FPGA blobs which not always work as expected. All in all it was a ten unit monster which used something like 4000W in steady state and a dozen of industrial coolers at max to cool it off.

And today that is replaced with a single relatively tiny in area chip (those old FPGAs were huge) from Broadcom, which does literally everything and complies with newest standard and uses tens of watts of power, and it is passively cooled. It's not quite the correct comparison since arch changed in the meantime, but if someone would build an exact replacement for that older big device using new chips and have the same specs, it would be half as big and use under 1000W or even less. And all software is ready to use without reinventing half of it manually.

But yeah, Broadcom's support is slow and opaque. and they will stall any non-major customer for month for almost any request, because they are prioritizing different tasks internally. It's like a drug dealer dependency and there is only one dealer in your town :) .