I think what you are saying is a sha-256 asic is fairly simple and they should get it right the first time

?
Yeah. This is pretty much a student project.
So, in this arena - price wise what would be a very reasonable estimate of how much it would cost BFL?
(so I know if the major effort to very slightly possibly invalidate sha256 would be worth the while to kill their company)
No idea. I always worked in a long-term R&D teams. I don't know anyone who does merchant one-shot jobs.