You might be surprised. I worked for an organisation that got ~1000 requests a year up until recently, each request involved going into every system manually, taking screenshots, tagging files etc. Quite often a good few hours per request and on a few memorable occasions, several days work for a single request. It definitely does cost many larger companies, but to varying degrees.

In the few cases that got a GDPR request, I actually talked to humans. Also, a human has to read my mail in the first place.

Note that I'm also doing this because I'm interested in the data, so its much less waste of time.