"Bloat" here is a virtue. Heroku removes two levels of drudgery and administration between you and the hardware. Who wants to be racking hardware? Who wants to be patching the OS? Who wants to be dealing with package vulnerabilities? None of this helps actually build the business
Lock-in is minimal, particularly if it's a self contained app and you're not using a lot of services. There are countless examples of companies who've moved off of Heroku when they've gotten big. Plus there's also lock-in using EC2, S3, AWS. There's lock-in of some level regardless where you run your stuff.
Future cost is also really, very very low because P(success) is, sadly, super low.