How much should you spend on security?

Both lines of research are limited by some sense of waste: in time or money.

When should you stop? When some acceptable standard is reached and a certain amount of risk is accepted.

In the case of GoF, if it wasn't somehow profitable, then the research would likely cease to exist.