>expect the goal is fixing bugs that show up and occasionally adding a feature that's needed by this organization.

Even if we assume a clean and bug free port, and no compatibility required moving forward, and a scope that doesn't involve security risks, that's already non trivial, since it's a codebase no one has context of.

Probably not 500k worth of maintainance (because wtf were they doing in the first place) but I don't buy placing the current cost at 0.