This is a great point, however as many security researchers will tell you, the cost of an exploit goes down exponentially over time.

Yesterday's hash attack that required $100m supercomputer will require a $10k GPU, which is 5 years will require a $100 GPU. (Not talking about the math changing, but it's been more about weaknesses in S-boxes and other parts of older hash functions that get slowly chipped away)

Similarly, yesterday's system that takes an attacker 3 days to MITM your machine, will take 3 hours, and then will be somebody's python script that installs and aggregates millions of exploits.

So in general, the cost and benefit variables are constantly changing under us.

Actually I was referring to the cost to the user who wishes to protect themself. Signal is designed to be fairly low "cost" i.e. easy to use. If they can find a way to make it more secure without making it harder to use they should and probably will do it. For most cases, the benefit of privacy probably doesn't warrant going through more trouble than this.

For those cases where somebody needs more protection, there's a way to go through a little more trouble to use Signal more diligently (agree with important parties not to change keys for a period of time).

To your point though: the cost of executing MITM doesn't just include the equipment, it includes showing ones hand by being discovered.

>Similarly, yesterday's system that takes an attacker 3 days to MITM your machine, will take 3 hours, and then will be somebody's python script that installs and aggregates millions of exploits.

The big cost of a MITM attack is getting in the middle. The cost of doing the actual attack is minimal.

By not knowing which peers have verified numbers, the risk of getting caught that you're in the middle is very high, so that big cost for getting there will be for nothing (and actually get way more costly because you alerted the subjects).