They can choose when and where to attack, but you have to defend everywhere all the time. I suspect we're in a situation where cost of being competent > probability of lulz * cost of remediation.
Yup, unfortunately this is true, and half-assing it because of this is what gets us onerous new internet legislation.