I'm still not fully convinced by your point about what's best to fuel an academic career. While putting it as trying to find vulnerabilities into some specific

I'm still not fully convinced by your point about what's best to fuel an academic career. While putting it as trying to find vulnerabilities into some specific cryptosystem largely believed to be secure indeed doesn't sound that interesting, if you instead put it as finding new attacks for elliptic curve cryptography we're back again the "cool paper with lots of citations" territory. As a side note, in the past a PhD student was tasked with the "not interesting sounding and apparently useless in practice" task of filling the gaps in OCB2's security proof. That's how it was discovered that it was utterly broken.