I am wondering how much time it would take to a Magento expert to install Security patches like the one we just did.
Is it something easy to manage when you are not a Magento expert?
This should be rather simple to do. More than Magento, it requires some basic CLI knowledge to apply the patches. Typically it can be done in one minute or less, of course assuming none of the affected files have been modified.
Testing can take a bit longer than that though depending on your QA protocol.
So would you think that 3.5 hours to do this is «over-billing»?
For me it is over billing. That said this depends on the process you have in place, especially around QA. I would think 1-2 hours is okay (but I am not QA).
We just patched 4 stores and all of them were done in around 2 hours (including QA)
Don't pay for installing this. We can help you install the patches for free! We already helped most of our customers installing these patches and we can help you too.
You can also do if yourself with the guide we have prepared: http://magecomp.com/blog/how-to-install-magento-security-patches/
SECURITY DISCLAIMER: The above website contains Magento Security Patch files which are self-hosted by the user and as such unsafe. Magento Forum advise all users to only download patch files from the official Magento Downloads page.