You compare it to the cost of developing and certifying a new safety critical system. I recommend the recent talk from the team that investigated the Polish train corruption scandal. It goes into the hardware and software on these older train systems. They're essentially using them as PLC controllers, not as networked general purpose machines.