I wonder if it wasn't the value (people-hours aren't hard to calculate) but a risk assessment. If their system has been working just fine, but the new system en

I wonder if it wasn't the value (people-hours aren't hard to calculate) but a risk assessment. If their system has been working just fine, but the new system entailed major risks (startup going out of business, hosted off-site, backups not in their control, PII / security issues) the calculation gets a lot worse.