Yes the last line is a cast statement. Casting does have a cost associated with it but it is insignificant as compared to the cost of serialization. I doubt it would even show up on a profiler.
Think of what serialization involves.
- Processing a byte stream
- Creating types based on metadata information
- Conversion between byte arrays and data types
Any of these operations are significantly more expensive than a single cast operation.
EDIT As to why it requires casting at all.
There are a couple of reasons here. The first is that the deserialization APIs have no way of knowing what the type of the byte stream is before it inspects it. So the only choice the API has in terms of a return type in metadata is Object.
Secondly, deserialization must support literally any type that is serializable. In order to function it must pick a return type for the method that is applicable to all types which can be serialized. The only type available that meets that is object.