Isn’t a vulnerability assessment something that only large companies can afford?

No, not really.

The cost of a vulnerability assessment depends on the scope.

Each project is different in scope and objectives, therefore, the cost varies based on how complicated the project is.