Nougat

Bad actors can afford $50 the same as good ones.

The difference between $0 and $50 isn’t really relevant.

LetsEncrypt is legit. A downside is that the certs expire after 90 days. However, that also carries an upside in that it limits the damage in case a certificate is compromised. There are procedures by which you can automatically renew/request (I forget whether they allow renewing an existing cert or require a brand new one) LE certs and apply them to your application, but that can be fiddly to configure.

If you’re not comfortable with configuring automatic certificate cycling, a long-term paid cert would be more appropriate.

If you are accepting payments, you absolutely want to offload that to a third party payment processor, so that you don’t have to go through the hassle of doing PCI compliance.