Sure the server hardware itself might cost only $5,000 a year, but it can't just be left there on its own forever, as seen with the ongoing log4j vuln. Either it costs that much and puts their entire network at risk, or it costs a lot more due to engineering costs for maintenance.