My sense is "you get what you pay for" logic applies here and naturally the vendors will exploit this. I also imagine the internal negotiation between whoever w

My sense is "you get what you pay for" logic applies here and naturally the vendors will exploit this. I also imagine the internal negotiation between whoever wants to purchase the software and the bean counters inevitably includes "sure it's a lot, but how much would a data breach cost us?"