Well our engine lisence cost just under $10k which gives us the ability to develop new titles with it which have to be registered with our engine provider for their records.
There are other costs dependant on the target market, which for Arcade only titles is considerably less compared to the PC game market, (one of the reasons we have not moved into this market yet).
Im not particularly interested in current cheats for current games per say, but I am interested in the whole process. I can not agree with you more, regarding finding the holes before shipping a title, instead of expecting an AC to plug them all up, which is more forgivable for small firms like pterodon, but when companies like EA fail to do this I am frankly appalled. As well as the fact that huge organisations, like government bodies, are as open to these exploits as the games industry, although this poses more of a problem than some guy running around in your game with some super ability.
To aquire AC's as you say, may well be free, certainly to the public but in most cases some level of funding must come from the developers, outsourcing this to an established firm would seem the direction that most take...
As I mention my own programming experience is pretty wide, but when it comes to this side, exploiting flaws, I must say I have limited knowledge outside of the average persons understanding. However should we find ourselves in a position where this is a factor we need to understand I suspect we would follow the common path of outsourcing to someone who does. Obviously establishing a good level of communication between the parties would be our first priority, to look at what should be tied up before handing a project over to the AC contractor. I suspect this is the first place many developers stubble over and failing here can result to more exploitable 'holes', thus creating more exploits.
I think other community related problems arrise when developers are tight lipped about these flaws which breeds discord within the titles developing community, legit players or exploit players. Both communities are as valid as each other and IMHO a more open approach to both would improve them no-end.
I don't pretend to share the ethos of the exploit community but that is not to say that I don't understand it. This kind of grey area can get a little murky with some players sitting on the fence... but all the same these communities are what keep your title in circlation... anyway I digress...
Maybe if developers actually worked along side communities like TKC they could learn from each other, and in turn create an environment where players from either camp can decide where they want to play, how they want to play etc...
There are some games as you know that run international leagues, plagued with reports of cheating or other types of exploit. Yet if a better relationship with the exploit community had been developed, places like TKC could have helped provide a exploit free environment, or at least a closer to legit one. I remember years ago playing Diablo, from Blizzard, and I remember that their own server list had 2 zones, one for exploiters and one for legit (although not perfect if I recall), but at least they were working towards this goal. Yet the current consensus from developers seems to be one of denial, or at least to turn a blind eye until some new AC update can be released.... These are just conclusions based on ovservations I have made over the last 8 years as a small time games developer, and a long time as a game player.