This is indeed one of the cases where the same tools used by the "defenders" can also be used by the "attackers". There is a book which was unique for its time, in that it was the first to document the ways in which cryptography could be used not just as a defensive, but also an offensive (Malicious Cryptography: Exposing Cryptovirology, FWIW).
However, I put to you that you're missing the most significant bottleneck, which is to be measured using the same profilers that the software developers would use. Determine the most significant bottleneck using profilers, and use that; don't automatically assume that you'll find that bottleneck in exception-laden code.
The computational issue with exceptions is that there are classes of optimisations it can disable, but we focus too much on that. The real issue, and one that we don't discuss often enough, is that exceptions are like
goto, but in three dimensions (spanning not just one function, but multiple levels of function calls, to potentially create "spaghetti code"); when used inappropriately (which is easy to do, as in the case of
goto), they can turn maintenance into a serious headache! Thus, the most significant bottleneck of exceptions is much more likely measured in human hours, rather than CPU microseconds...
Hence, from a security perspective, and at a level much higher than the machine level... at a personal level, you could certainly use exceptions as a form of denial of service. DEFCON 23 presented a similar idea in a presentation entitled Repsych: Psychological Warfare in Reverse Engineering. The goal, however, is not to bring down a system but to convince prying eyes to surrender and walk away. It's an interpersonal denial of service. You could use this idea of yours with moderate success, to torment antivirus analysts for example.
Otherwise, I think you should focus on using your profiler to determine the most significant bottleneck.