In GSM, something like the following happens:
1) User submits SMS to their mobile phone.
2) Phone starts paging on a random access channel (no synchronization, lots of phones trying to talk at the same time - limited resources for phones to transmit, and limited chance for base station to receive an intact message). Increased load on these channels require operator to have increased capacity, and thus increased spectrum, increased hardware to handle peak throughput (even if network is idle most of the time - one reason prices may not drop as the network's popularity increases)
3) Base station manages to hear an intact access request, allocates a dedicates timeslot on a control channel (a timeslice of spectrum dedicated entirely to one particular handset - the number of available slices in a given area is more likely measured in the 10s, not the 100s), uses yet more spectrum to inform phone of allocation.
4) Phone indicates desire via dedicated control channel to start SMS transaction.
[half a second of allocated time on a licensed band elapses]
5) Phone transmits message.
6) Phone retransmits message due to poor network visibility.
7) Network signals SMS received, closes transaction.
[resources used within network to route, store and forward message, payment made to peering network to which the target phone is connected to]
8) Remote network begins paging target handset on a camping timeslot it shares with a bunch of other phones, on frequencies covered by a second billion dollar spectrum license.
9) Remote phone wakes up, begins placing load on random access channel.
[lots of retries and corrupting of other users' random access requests later]
10) Remote network allocates control timeslot, and begins attempting to inform target phone of its allocation.
[another few second of allocated spectrum go here]
I spent two years working on carrier software for this section of the SMS transmission procedure and there are plenty of things here which cost the carriers money. SMS is definitely not free to the carrier.
Also, from my understanding, they don't actually piggy-back on the control messages, at least not after they have entered the wired part of the system (I never worked in the over-the-air part of the system, so have no knowledge of what happens there). That is, even if the control messages were sent constantly, SMS messages don't get a free ride, but rather they share the bandwidth with the control messages, since those messages do not require near as much bandwidth as the voice channels do.
As an aside, one carrier we installed our system in could only handle a thousand or two messages per second tops, after that, messages were dropped (well, TCAP transactions meant they were re-transmitted later), so there isn't some magical unlimited bandwidth available to SMS messages.
Thats a cool and complex protocol, but prices have nothing to do with that.
When I worked in telecoms a couple of years ago, we installed our SMS anti spam/fraud system in a network where a disproportionate amount of SMS traffic was caused by a virus on handsets that was constantly sending SMS messages. This was costing the carrier enough money that they installed our expensive anti spam system.
So all the tower and network construction and maintenance is free? I see this 'it cost nothing' all the time, but it's really a dishonest way to look at the cost of text by putting the entire infrastructure cost on voice.