Beyond Runtimes and Optimality: Challenges and Opportunities in Evaluating Deployed Security Systems