Im not from the US, so im not entirely sure what a 'National Security Letter' entails. Wikipedia seems to suggest a very broad spectrum of requests. If it's anything like europe, the vast majority of those requests are about email boxes. Actual wiretaps, where all data on the line is forwarded to law enforcement, is likely a small percentage of requests. Ok, maybe Comcast could get a few hundred, since they're quite big, but I highly doubt thousands.
You're right, a lot of the costs are in administrative and legal departments. Are the requests valid, are they possible (you wouldnt believe how often they still ask things you just cant do or know), etc. But there definitely are pretty high infrastructure costs! If you think an ISP that takes this seriously will let normal infrastructure handle wiretapping, you are wrong (at least, I would hope you are). You have to put a totally separate, totally unconnected, fibre splicing, infrastructure in place. Why? Because you cant have regular network engineers or even hackers get their hands on extremely sensitive wire tapping information. Knowing who is being wiretapped is information that needs to be secret, in some cases it may even fall under intelligence services. This equipment needs to be in a secure location, and even network engineers that are 'curious' should not be able to get their hands on the data inside these cabinets. Now imagine you have a pretty spread out network, directly connected to multiple peering points, so no single point to put taps but instead many, maybe dozens or even more, you are looking at serious costs. Not that many boxes can handle multiple 10gbit fibre sniffing links you know.
I cant speak for Comcast, but the idea that any ISP would gladly get more warrants just so they could recoup their costs sounds ridiculous to me. This stuff is being implemented against the will of most companies. Regular people work there, no one with a white cat on their lap :)
Regards,
Cor