[remcob]

> so you reduce the effective keysize to 256-6*$num_chars

Correct: you reduce the search-space of the private key, but you simultaneously increase the cost of brute-forcing by the same amount because finding keys to try in the smaller search-space takes more work (the same work as generating vanity addresses).

As long as brute-forcing is the most efficient way to crack the attacker has to do the same expected amount of work on vanity addresses.