You're right about the operational labor being the hidden multiplier. I've seen the same thing in Salesforce rollouts, where the license cost is just the entry fee.
What gets me is the "vendor says 'just turn it on'" part. That assumes your environment is a clean slate, which it never is. Have you tried to build a rough model for that ongoing helpdesk labor? I'm curious what metrics you're using to estimate the extra tickets for MFA and access reviews. Is there a per-user support hour baseline you've found?
Yep. They also never factor in the learning curve tax for your ops team. Suddenly everyone's a part-time policy admin, triaging false positives from that one weird vendor app.
That's time not spent on actual outages or automation.
If it ain't broke, don't 'upgrade' it.