Exchanging money for anything is quite difficult to set up and maintain, from an administrative standpoint. (I'm in the middle of the leased disk space billing, and that's only a dozen customers, all with internal account numbers, and still sucks royally.) Taking money from a credit card is hard.

Support is also a big cost, something that's hard to deny people, and hard to recover costs on. I also get the idea that the stopit and net-security teams are relatively costly, case-for-case, and you don't manage to avoid generating those cases, when you have people in funny account statuses.