In fact, several submissions to the Zcash Open Miner Contest, at
https://zcashminers.org/submissions
exhibit time-memory tradeoffs that were not considered in that paper, invalidating some of its claims.
My own, memory latency bound, proof-of-work called Cuckoo Cycle
https://github.com/tromp/cuckoo
offers $5000 in bounties for invalidating its claims of near-optimal implementations and trade-off resistence.
The units can be set somewhat arbitrarily. Although it is important for the unit to be memory-hard-enough to not accelerate well on a GPU.
I would think that's a rather wide "target" which can be hit by scrypt at a certain difficulty.
Needless to say, it's still possible to get it wrong, e.g. Litecoin.
Just think of it purely in the manner of "why run exactly one unit of the work? why not run a hundredth of that unit to validate the proof?" An asymmetry allows you to more quickly verify the ledger, which is both a startup cost and a lesser ongoing cost for everyone.
I'm wondering however if there is a connection with asymmetric encryption, though. Imagine a one-way function h and two functions f(x), g(x) such that f(g(x)) = x. Suppose the task is "find M such that g(h(M)) lies within some narrow subset," then if g is much slower than f, you can verify a pair (M, g_h_M) not by verifying that g(h(M)) = M (slow) but rather by verifying that f(g_h_M) = h(M) (much faster). The importance of h is just that for the most obvious application (f(x) = x^E modulo N, g(x) = x^D modulo N), you also have that g(f(x)) = x, and this is a relatively common property of inverse functions.
Because it is a solution in search of a problem in many cases?