Yes, each airbag vest costs money to produce, that's why you pay for them, and why it's shit that this company is charging an ongoing subscription that actively disables them when you miss a payment, because the vests they've already sent out don't cost them any money to maintain

And yes, each copy of a backported security update doesn't cost meaningful amounts of money, but you're not paying for just a copy of one update, you're paying for an ongoing service that provides constant backports of security updates for loads of packages (and if you're a personal user, as other people mentioned, you don't even have to pay for that!), those backports are not free to maintain, companies charging for extended support that is nothing new, especially when they're long term support distros targeting enterprise