That does seem low for everything they're asking for, even though Plone does many of those things out of the box. The items that strike me as 'extra work':
PCI compliance
Event registration and payment: because of the payment part I'd use a 3rd party service like ti.to or Eventbrite. That's what we've done with most of the Plone conferences and symposia.
Email newsletters: you can do it with Plone add-ons but it can also be very easy to use a 3rd party service, like MailChimp, and put a "subscribe me" form on your Plone site that is actually the 3rd party service's subscription form
Reporting for accounts receivable and budget tracking... this one makes me LMAO. Get real, for $6000?
Calendar management: very open ended. For whom, how many users, etc.?
A nice custom theme is going to cost a good chunk of that $6000. Even if you start with a themeforest theme and put it into Diazo it will take a few hours.
First take the budget and divide it by your day rate and see if the number of working days is reasonable...for the given project description above: no.
For agreeing on a fixed price you need to have the very big picture and a deep understanding of the requirement details, an idea about implementation details and the experience from former projects.
Integration with third party services (payment systems) are always a risk and usually a major PITA (for technical and compliance reasons) -> big risk, unless you know the payment backend.
The key points for any project estimate is experience, experience, experience, detailed and clear requirements, knowledge of all involved components.
Talk of risk estimation: one major risk in Plone projects nowadays is Plone itself. There are so many unfixed small and larger issues with Plone 5 that can ruin your Plone cost estimate...I only want to mention my issues with CSRF and plone.protect here. That's the reason why I usually refuse to do any fixed price projects...customer pays for the time that is takes...I am no longer accepting projects that outsource any risk to the vendor or the necessary project buffer is pretty high.