You are conflating the chance of being singled out of by PRISM with the final outcome of the process involving its use, and the benefits vs. damage done.
He's not measuring, or even saying anything about, the latter.
The point he is making is that to get any benefits out of PRISM, no matter how you value those benefits, you'll need to do a massive amount of further investigation to be able to identify an actual terrorist (unless you were to take drastic action; e.g. imprisoning everyone that gets "reported" - but the high number of reports to bad guys also means that becomes "impossible")
He's not measuring, or even saying anything about, the latter.
The point he is making is that to get any benefits out of PRISM, no matter how you value those benefits, you'll need to do a massive amount of further investigation to be able to identify an actual terrorist (unless you were to take drastic action; e.g. imprisoning everyone that gets "reported" - but the high number of reports to bad guys also means that becomes "impossible")