Notes: I have very limited knowledge and experience in this field. My boss does not want to spend a penny more that what we already paid for. The website has a form that sends a message to our email address and that sparked the security conversation.
Context: My boss bought a package from a webdesign company. This package included a resigned for the site, 12 months of hosting, and an Account Manager that would help us with the site. I talked with our Account Manager about the security of the new site and he tried to sell us another package for an additional $2,000. He said that if we bought the package, they would ban any IP addresses that are suspected of performing MITM attacks, DDOS attacks, etc. He claimed there was a 100% guarantee that no attack could bypass their security. He also said that our website will get a green lock at the left side of the URL bar.
What I think: I think the package he offered is a scam. I did some reading and according to what I read, the package he described won't stop MITM attacks or Large Scale DDOS attacks. To my knowledge, there is no security measure that cannot be bypassed.
Questions: Am I wrong in thinking that what he offered is a scam? Should we consider buying the package? Am I better off just using a free SSL such as Zero SSL?
Thanks, and sorry if I posted this in the wrong exchange or if this is not the right place to ask. I'm not sure where else to ask these questions.