It is really hard to have vulerabilities with static html. Similarly, hosting these costs nothing. Usually in the ballpark of $3/year, the DNS alone is the dominate cost. And if they do get a sudden inrush of traffic, static hosts need to see a thousand times more load than stock wordpress before they fall down.
Come to think of it, I've never had a client that was the correct size for Wordpress. They were either way too small or way too large.
I had a client who wanted a static site, but at the last minute decided they needed a "news" sidebar on every page that they could update. This was before any of the off the shelf solutions existed (to mixing static and dynamic content), so I wrote some javascript (before jquery made ajax easy) that grabbed the content from a flat file.
Long story short, a few years later, they had someone on staff who knew some html, and they basically turned that tiny sidebar from a div displaying 2 or 3 paragraphs of text into an entire website--complete with oversized videos, rotating image headers, and dozens of links.
Also I hadn't thought of S3 - that's a good shout.
The transfer rate is $1/GB. If you don't have many pictures and serve pre-gzipped html/css/js (needs a custom .htaccess) the bill can be very low.
And they, or an unwitting employee, start using it to communicate information they shouldn't.
And their account gets owned. (Keep in mind, the content is no longer just public web pages...)
And... Even if the web site hosting should have been done this way, they still needed help/advice/pressure to be more clueful about their IT deployment and use.
A lot of small businesses look for the minimum and think things should just work.
Separately, as a favor, I spent a weekend cleaning such a business's systems after an employee clicked on a malicious attachment.
When I told them what that service was worth (particularly on short notice and over a weekend) -- mind you, I wasn't charging them anything, just trying to put the fear of God into them to prevent a repeat and to motivate some better policy and behavior -- they completely balked. One partner "called someone" and claimed a simple sub $100 scan with a packaged product would have taken care of the problem. (Never mind that they had multiple infections on multiple machines and a raft of outdated products presenting serious security implications.)
They were in a cash flow crisis. If I hadn't had billing up by Monday morning, they would have been severely screwed. Yet, they were unwilling to assign any significant dollar amount to what I'd done.
The other side of businesses that pay too much for custom web development, is businesses that treat their IT systems like a consumer-level Windows XP box. And we know what happens to those.
P.S. IT, IS... whichever acronym floats your boat.