Does a hosting company have to be paid for an SSL certificate, or can I bring my own?

Commercial, in the overwhelming majority of cases.

The technical facts: a certificate has to be installed in the server configuration, and on shared hosting you do not control that configuration. So the host decides what may be installed. That is a real constraint and it is the lever the pricing rests on.

What has changed the economics completely is that free, automatically renewed, browser-trusted certificates are now standard. They are issued by a non-profit certificate authority, they are trusted by every mainstream browser, and they are what a large share of the web runs on. There is no security difference for ordinary use between one of those and a paid certificate at the basic level.

So the question to ask your host is precise: do you support automatic free certificates, and if not, will you install a certificate I provide? Most hosts using a standard control panel support the first, often with a single toggle, and many people paying for certificates have simply never found the toggle.

What you are paying for with a commercial certificate, so you can judge whether any of it applies:

• Extended validation, where the authority verifies the legal identity of the organisation. Browsers no longer display this distinctively, so its practical value has fallen a long way.
• Warranties attached to the certificate. These are much narrower than the marketing implies and almost never pay out to a site owner.
• Support, which for a small site is rarely the deciding factor.
• Longer validity, though maximum lifetimes have been shrinking industry-wide and automation is the direction of travel regardless.

For a personal site, a small business site, or a shop, the free automatic option is the correct choice and there is no asterisk on that.

If your host refuses both the free option and your own certificate, that is worth treating as information about the host rather than about certificates.

There is a route that works even with an uncooperative host: put a service in front of it that terminates TLS.

Several providers will sit between visitors and your hosting, present a valid certificate for your domain, and connect to your origin behind the scenes. The visitor gets HTTPS regardless of what your host supports, and the free tiers cover a small site comfortably.

Two caveats. The connection between that service and your origin should also be encrypted, or you have moved the problem rather than solved it. And it adds a dependency in front of your site, which is a real architectural decision rather than a free lunch.

Still, it is the standard escape hatch when the hosting will not cooperate and moving is not immediately practical.

One reason not to delay: browsers have been steadily increasing how loudly they mark plain HTTP, and search engines treat HTTPS as a positive signal.

So this is no longer only a security question. A site on plain HTTP looks broken to visitors in a way that is entirely outside your control, and it will get worse rather than better.