The core version is rarely the expensive part. What costs money is everything assembled around it: the custom theme built against an API that changed, the contributed module with no maintained branch, the content type whose fields no longer map to anything.
How we estimate it
We run the upgrade on a copy first and count the failures. That number, not a table of generalities, is what goes in the quote. It is usually honest and usually smaller than the client expects, because most of a current site is fine.
When to wait
If the site is secure, backed up and editor-friendly, an upgrade is a maintenance decision, not a crisis. Do it when there is a reason attached, and bundle it with the feature work that needs the newer version anyway.