I neither work at the Rijksmuseum nor live in the Netherlands, so the others who have contributed to this thread might have access to "inside information" that I don't have, but in my understanding, the Rijksmuseum was a pioneer of the "CC-0" license, which allows commercial use (and indeed any type of use whatsoever, completely for free), as explained in their open data policy. The Rijksmuseum has high-quality photographic documentation for a lot of objects in its collection, but not all of these images are released under CC-0 licenses. Photographs of works in the public domain (like this Mañjuśrī) are available for free download under a CC-0 license, but photographs of works that are still under copyright (basically: anything produced within the last couple of decades) are not.

The point is moot for manuscripts, which (as far as I understand) are all in the public domain, but as others have alluded to, repositories and collections may try to get scholars to agree to (verbal or written) terms of use before making or acquiring photographs.  Enforcement of those terms is another issue.