The performance fallback option is to just put a limit on the size of an address that can be subscribed. Because each update essentially requires a cumulative scan of the entire update history, that ultimately becomes necessary. So once the subscription scan hits a certain depth it just errors out and fails the subscription with a specific code. This would be a reasonable precaution for public servers. And since these queries operate over a collection of output links that are accumulated up-front, this is very simple and inexpensive to evaluate.
(edited)