The key point of Starkiller is that it wasn't intended for prolonged use. Fire once-Senate worlds are GONE. Republic is destabilized, leaving a power vacuum for them to step into. Theoretically, the second shot will never be needed, because from then on, the Galaxy KNOWS that they can wipe out an entire system in one shot. Anywhere. Any time. As to the vulnerability, it really wasn't that vulnerable. If they hadn't had a defector, a legendary pilot/saboteur, and one of the best fighter pilots in the galaxy all aligned against it, it would have shrugged off that attack like it was nothing. Cost wasn't a consideration for the First Order, though. They had planned to wipe out the Republic, step in, and rule through superior ground forces and sheer intimidation. Same as the Empire, only with a more publicized superweapon. Actually, the Death Star was a rather weak superweapon. Sharp limitations on range, significant telegraphing of intent, low overall kill potential, and a lot of other flaws made it much less viable than Starkiller.