I mostly see your point, except your argument seems to be missing the important fact that the payoff for the hackers is not guaranteed. To say someone is willing to spend up to 90% of the potential payoff without a guarantee that they will be paid out is missing a fundamental aspect of the economic equation here.
The scenario you gave should be fairly similar to any application outside of Ethereum that deals with money ie. a banking app, except for the fact that, like you mentioned, you can't prosecute someone.
Except it's made up numbers, and the the valuation's are actually much lower - the cost to find an exploit is not a linear investment of time and money, but a parallel one. Thousands of potential hackers are targeting you, and only have to succeed once to bankrupt you (the payoff is also non-linear - any given exploit probably works more then once).
The scenario you gave should be fairly similar to any application outside of Ethereum that deals with money ie. a banking app, except for the fact that, like you mentioned, you can't prosecute someone.