Maybe the price has jumped well beyond inflation, the tier you have paid for since the beginning is being retired, or the one-time license you bought years ago now requires a subscription just to keep functioning.
The more interesting problem is what the machine holds. Every person who has ever logged into a system from that computer and clicked “remember me” has left a credential sitting in the browser.
Most small businesses do have some form of backup. The problem is not that they have nothing but that what they have has never been verified.
Data breach notification laws do not distinguish between a hacker accessing your systems remotely and a person physically walking out with a device that holds the same data.