Section 508 is a U.S. federal procurement requirement. It applies to federal agencies and to vendors selling to federal agencies. If you're a private company with no federal customers, 508 does not legally apply to you.
What probably does apply: the ADA's effective-communication requirements, which courts have repeatedly held to cover commercial websites. The standard that's actually enforceable is WCAG 2.1 AA — and 2.2 AA increasingly. Most of the "508 compliance" services pitched to private companies are really WCAG-AA services with federal branding bolted on.
The pragmatic stance we recommend: aim for WCAG 2.2 AA. Hire a manual audit (not a tool-only audit) every 18 months. Fix the structural issues first — landmarks, focus order, alt text, form labels. Then chase the long tail.