You're right about the hidden engineering cost, but your cold storage retrieval SLA is optimistic. We built a similar pipeline for compliance data and the real-world retrieval latency was measured in days, not hours, due to vendor-side queueing and egress throttling. The promised "hours" assumed ideal conditions we never saw in production.
That six hour delay you mentioned would have breached our P1 incident response protocol twice over. We ended up maintaining a hot replica of critical logs anyway, negating the tiering savings entirely. The vendor's response was essentially "that's why you should buy the premium query package."
The core problem is exactly what you said: they're selling cheap storage while making the useful access to it prohibitively expensive. Any workaround just shifts the cost from their invoice to your payroll.
Mike