I'm not sure I agree that infosec costs would scale with number of users. Your tech stack is either vulnerable or it's not. A larger server would mean you're more of a desirable target, but a small server (which "ideally" every server would be) would still have those same vulnerabilities.
And servers need to be cost effective. Not everyone can afford to run a server out of the good of their heart, and those that are able to do that are already preselected to be fairly wealthy. So yes, even in a decentralized system money will always win.