Holy shit that's some of the biggest scammy bullshit I've heard. They took your site down then charged you to put it back up?! That's called ransom, like the ransomware that locks people's computers and won't unlock them without a credit card.
Yes Drupal has periodic security issues, just like Wordpress, or anything else on (or off) the internet. Find a new provider, ideally one that will migrate your site for you. Any reputable provider will do security updates for free, or at least provide them for you to do yourself.