Of course they are. It's standard SaaS to charge for security features ;)