Exactly. I doubt it was malice, I mostly suspect an agency used to large clients with no experience or methodology with small ones. A lot of what was set up for his website was stuff that only makes sense if the project is huge.
Let's say you want to set up a framework and it takes you XL amount of hours. That XL amount of hours is worth it if the website has 15,000 products and 75 pages of content. But if there's only one product and two pages, it's not worth it.
Same goes for the management time that crept into the budget. 20k extra on a 1 million contract is nothing and I would say expected. But on a 7k project? That's huge.
If the company has a lot of internal processing in between each step, it eats up a lot of the budget. Daily stand-up meetings, agile rituals, pull requests, handover to a QA department and bug fix rounds. Again, this makes sense for a large project but not for a small one.
Most companies that are used to a formula that works will not change for one customer.
If I had a metaphor, it would be this: If you want to travel 1500 kilometres, it makes sense to take a train. Boarding will be slow and the train will start out slow. But overall, you win. On the other hand, if you're only traveling 500 meters, it's a bit of a stretch. It is better to take a truck or a car.
The problem here is that the company was a train and promised safe travel to the next station 500 meters away. Were they being malicious? I doubt it, they probably made the train trip safe. They probably don't know the details of trucking and didn't recommend it.
Should they have recommended going with a smaller company? Maybe. But I don't know if I would consider that malicious. If anything, they should have been more transparent about their internal methodologies and ways of working so that the client could have properly consented to what he was getting into.