Cost-benefit is all well and good, but does it work? Does the technology yield results?

It really doesn't look like it. Here's the thing. If you're willing to take a few fairly simple precautions, you can and will be able to avoid NSA, GHCQ, or cranked-out Russian teenager surveillance for sensitive communications. People who really need to hide from the U.S. Government, generally already do. It is possible to avoid the BitLocker key escrow/ password reset backdoor by powering on your machine on an offline connection and disabling that section of the backup software. Off-The-Record messaging, which uses a different key for every chat session and thus any intercepted key is only useful for a single conversation, has been widely available for a very long time and can be applied to any messaging protocol. The most dangerous people are already capable of avoiding mass surveillance. What it comes down to is a choice. Do we want these products, which are not going anywhere, to be protecting innocent people as well as they do soldiers, journalists, victims and criminals, or do we want to leave innocents exposed by leaving known problems in critical infrastructure in order to mostly fail to track criminals?