I'm curious, has anyone ever seen a software patent novel enough that it could be considered a "non-obvious" solution to the problem that the inventor is trying to attack?
RSA was patent-encumbered for a long time too. You can formulate a similar argument about that. "RSA makes systems safer [ed: no it doesn't, but continuing...], so it's wrong to allow it to be patented".
The step from (1) to (2) seems doubtful. If the CR people hadn't been able to patent a bunch of ways to deal with DPAs, they might none the less have published about them. It's not as if no one ever tells the world about a security vulnerability without a patent-based incentive.
The step from (2) to (3) seems doubtful. It seems more likely that without CR, sooner or later someone else would have thought of differential power attacks and published about them. Unless CR are just much much smarter than everyone else -- in which case, the guys in black hats would have been just as much worse off as the guys in white hats.
The step from (3) to (4) is OK, with the proviso I just mentioned: it seems that the obvious way for (3) to be true would tend to make the vulnerability matter much less.
Regarding (1) to (2): sure, maybe CRI would have published even without compensation. Just like maybe I'd do my job part-time for free anyways even if I wasn't getting paid. You can say that for anyone who's doing what they love: musicians, lawyers, architects. But what's the win for not compensating CRI? Huge consumer electronics companies have to pay slightly less NRE to build new products. I'd rather have CRI in the world.
I don't think "maybe CRI would have published even without compensation" is at all the same as "maybe I'd do my job part-time for free". In a world in which CRI couldn't patent anti-DPA measures, I'm betting they'd still be able to get paid plenty well for doing crypto. A fair number of super-smart crypto people are, after all, and they don't all have CRI's patent portfolio. So the analogy is more "maybe I'd publish interesting and useful crypto stuff for free even though it isn't what I'm getting paid for". Which, in fact, you do.
(If you're inclined to object that what you publish for free is not innovative on the scale of the discovery of DPA attacks, let me remind you that you just claimed that CRI are much much smarter than you are.)
For the avoidance of doubt, I am not positively claiming that the world would be better with a patent system in which CRI couldn't have got the patents they have. I don't know whether it would. I just don't think your argument supports your claims very well on this point.
[I know DES isn't patented, and there's plenty of good reasons why you don't want a patented crypto algorithm, but I think they certainly qualify.]