A threat actor installing software specifically designed to log and monitor attacks from threat actors would be considered a blunder, no?

Well they aren't wrong. Crowdstrike showed how much of a blunder it can become.