I think this kind of argument works both ways
Attacking servers is harder and probably may give you better "reward" (stolen data), but...
Attacking normal people is easier (I think its fair to assume normal user is worse at computers than e.g trained admin), so you can do it at bigger scale and normal user may not want to sue/find you/call cops meanwhile if you're hacking companies then things are more likely to be very serious.
Thus, both are under constant attacks.