A static site is the leanest way to run a web site. Static sites are technologically simpler than dynamic sites, they load pages faster and cost less to run.
In the early days of the internet, all web sites were 'static'. A site was just a collection of HTML files containing all the code and content. Dynamic sites backed by CMS databases were introduced so non technical people could manage site content, but these sites are slow. Static Site generators were created to get the benefits of static sites and allow non technical people to update the content.
Because they are essentially just collections of files served by a web server, only file storage and a webserver are needed to run a static site. Databases running in the cloud to support dynamic sites add a lot of cost.
Yes, being Opensource means static site generators are free to use. This helps make running a static site economical, but it also helps with security as Opensource code gets a lot of scrutiny due to its 'openness'.
A simpler technology footprint means there is less attack surface in a static site. The more technology you have the more there is to exploit for hackers, and the more that has to be managed and patched. Static sites don't have a CMS backend connected to the site, so there is no entry point to the site content.