Big part of the concept of a fediverse is the decentralisation. It would be beneficial I think for more people to register on smaller-medium sized instances to help reduce the load on the large few
Mine is running on a €2.49 Hetzner VM. I already have a domain, so Lemmy is just set up on a subdomain. I secured it myself (that sort of thing is my day job). I don't think I'll need to upgrade, because it's a closed instance with only 2 users.
All told, it would be maybe €50/year if you're starting from nothing.
I haven't researched it at all but I'd be very surprised if you needed anything more than a domain name (basically free as long as you don't go for a common TLD) and somewhere to host it (literally free if you do it on a home PC but that comes with other issues). Cloudflare and extra security are nice but aren't necessary for something like this.