Most people are using third party cloud providers, and they’re very invested in securing their service. The overhead is mainly keeping Discourse itself updated, which plenty of people manage to do (in fact, most sites using Discourse do it themselves!).
Even for actual computer-in-my-home hosting… you have to pay some more attention to security, but it’s certainly not in the “hundreds of thousands of dollars per year” area of complicated.
Paying us for hosting when possible is certainly a great way to support our work on Discourse though!