This amount of money is well within what you'd expect to pay for various proprietary software packages. You can probably add up all unused-but-not-deleted VMs, S3 buckets, and their payroll/vacation tracking software and you're at 1 million dollars.
I've started responding to "hey, do you want to talk to sales?" messages with "sure", just to see what stuff costs in the real world. Everything is 5 or 6 figures, even static website hosting. I wouldn't pay $20,000 a month to host a static website, but someone must be, because that's what people are asking for on these calls. I can see a world where you say yes to even a few of these vendors, and the cost of securing the entire Ruby ecosystem looks like a rounding error in comparison.
At the end of the day, I doubt the investors care. If they want to cut costs, there are much better ways.