As for the costs, Cyanogen seems to prove that they can be pretty low. They support a lot of devices with very little funding to do so, partly because they are open source and rely on volunteers.
That, and their users don't seem to care if random small things break from time to time. Fortunately bluetooth stereo is much more mainstream now than it used to be, so the volunteer testers are far more likely to notice when it breaks. Back in the early days of CM it seemed like it only worked 70% of the time, but the average college student didn't use it so they didn't notice. That was before the M-series builds as well, so running "stable" meant just waiting for the next version of Android to come out so that you could use the last one, and it was basically abandonware.
Some companies pay them for support, which seems like a reasonable way to do long term updates.
As far as I've noticed, their paid firmware is just fine, probably because they actually give it serious QA, and of course it doesn't hurt that they have full access to the drivers/etc (which to be fair is a major handicap for their free efforts).
I also like that they have personally committed to updates for the phones they support, and they don't just say "it is up to your OEM." I get the impression that if a company like Oneplus folded that CM would still keep the OS updated for existing owners. Of course, they've yet to be tested on that.
Don't get me wrong, CM does great work. I just wouldn't say that they are without issue, or proof that the free software model works without any commercial ties. The areas where CM seems to go toe-to-toe with other OEMs in every regard is in the cases where they do have commercial ties.