The problem likely isn't the money, but rather it would paint a big red target on their back with a legal entity to sue. And it wouldn't surprise me if Microsoft would easily revoke a certificate, even without any legal judgment.

That's the problem with code signing. It's just an attempt to graft the status quo monkeysphere onto the digital realm - you "know" the author of the code, so therefore you trust it completely, because you can sue them post-hoc if they harm you. This doesn't scale to the digital world, but that hasn't stopped these unimaginative power-hungry companies from trying to force us into it.