It makes sense on my side, from several similar cases that I've found it can even charge more than that.

The recovery process isn't as simple as it sounds. If let's say rollbit has the same system as cexes wallet in general (deposit funds are swept every few minutes). The privkeys is generated automatically by the system which is then collected together with thousands of other privkeys in 1 safe which is tightly locked by the master key (1st rule) and it should never be opened (2nd rule). If you have to find a privkey linked to OP address, you must have the ability and the credentials to access the master key, open the safe and scramble it (contrary to the 2nd rule). Up to this point, the safe has actually leaked and you are the only person who will be sued if anything unexpected happens.