EDS Child Support System – In 2004, EDS introduced a highly complex IT system to the U.K.’s Child Support Agency (CSA). At the exact same time, the Department for Work and Pensions (DWP) decided to restructure the entire agency. The two pieces of software were completely incompatible, and irreversible errors were introduced as a result. The system somehow managed to overpay 1.9 million people, underpay another 700,000, had $7 billion in uncollected child support payments, a backlog of 239,000 cases, 36,000 new cases “stuck” in the system, and has cost the UK taxpayers over $1 billion to date.
The paper "The Real Cost of Software Errors" (IEEE 2009, https://www.ll.mit.edu/mission/cybersec/publications/publication-files/full_papers/2009_03_01_Zhivich_IEEES-P_FP.pdf) gives some interesting examples; it also deals with software errors resulting in casualties.
In the archive of ACM Forum on Risks to the Public in Computers and Related Systems (RiSKS, http://catless.ncl.ac.uk/Risks/), more examples can be found, but you have to dig around a little.
The website "10 of the most costly software errors in history" (https://raygun.io/blog/2014/05/10-costly-software-errors-history/) gives also some examples.
I once worked as supervisor of software configuration management and quality control in an aerospace corporation. I am not familiar with the NIST paper but I can say definitely that estimating the life-cycle-cost of a software error is very complex and depends on the policies and culture of the software development organization. Any claim that a "universal" method of cost estimate is possible would be a massive overstatement.
For example, Microsoft will let a software bug exist through several software updates and that approach has been largely accepted by users.
On the other hand, in avionics and aircraft applications, a software error can cost lifes and the extent to which software is tested and errors eliminated is very costly.
The original space shuttle ran 4 computers. Three identical and a 4th developed independently. Computation results were compared at milestones in the computing cycle and a vote taken as to correctness.
In the life cycle of software, the bug must be detected and analyzed. A revision must be written and extensively tested and documented. The software revision must be introduced into the product cycle. The revision must be distributed as a "fix" to previous customers. Every software company does it differently with different costs depending on the safety and social impact of the software.