I had a client who wanted a static site, but at the last minute decided they needed a "news" sidebar on every page that they could update. This was before any of the off the shelf solutions existed (to mixing static and dynamic content), so I wrote some javascript (before jquery made ajax easy) that grabbed the content from a flat file.
Long story short, a few years later, they had someone on staff who knew some html, and they basically turned that tiny sidebar from a div displaying 2 or 3 paragraphs of text into an entire website--complete with oversized videos, rotating image headers, and dozens of links.
Also I hadn't thought of S3 - that's a good shout.
The transfer rate is $1/GB. If you don't have many pictures and serve pre-gzipped html/css/js (needs a custom .htaccess) the bill can be very low.
It is really hard to have vulerabilities with static html. Similarly, hosting these costs nothing. Usually in the ballpark of $3/year, the DNS alone is the dominate cost. And if they do get a sudden inrush of traffic, static hosts need to see a thousand times more load than stock wordpress before they fall down.
Come to think of it, I've never had a client that was the correct size for Wordpress. They were either way too small or way too large.