It is much more appealing than the network security researchers think, because they don't think like affiliate marketers.
Assume Bob buys $100 of Viagra for you. They count it as worth being $100, and wonder how it could be profitable with the high costs of spamming. What they're missing is what direct marketers call the "backend": now that we've established Bob is willing to spend money on the Internet to improve his performance, he becomes an extraordinarily valuable source of recurring revenue. His expected LTV might well be over a thousand bucks!