I think you’ll find that all the most popular free security plugins available here on the WordPress repository have a paid premium version with extended functionality. That said, they typically do a fantastic job in their standard state, and Sucuri seem to offer a great selection of features (Security Activity Auditing, File Integrity Monitoring, Remote Malware Scanning, Blacklist Monitoring, Effective Security Hardening, Post-Hack Security Actions, Security Notifications, Website Firewall) and a knowledgeable support technician to offer free, timely and intelligent responses to plugin/security-related issues.
Perhaps it’s best to view such security plugins as fulfilling part of a broader security strategy that includes strong credentials management, careful installation of only well-maintained plugins/themes, regular updating of plugins/themes/core, selection of host, regular back-ups, etc.
The codex on hardening WordPress offers excellent advice on developing a full security strategy, while there are great advanced security measures to be taken though the 5G Firewall and the Moz Guide.
Best wishes with whatever strategy you put in place.