That's because it isn't easier to break things than to build them. Most crypto attacks require more cleverness and more sophisticated math than the original algorithm required, a point that is all but spelled out for you in the crypto books when they say "don't even bother trying to build your own cipher until you've broken several others first".
Or take software. Does anyone actually believe that it was harder to write code for the ActionScript interpreter than it was to get Dowd's exploit (http://bit.ly/13OjyR) working? Lots of people have written interpreters (even fast threaded stack interpreters). Nobody has written an exploit this sophisticated. And this is just an exploit! It isn't even a clever vulnerability!
This is Ira Winkler's big thing. Ira has, as far as I can tell, no discernable technical skills. He's never published any research. He's never published any code. He's written and contributed to several third- and fourth-tier books, and he pundits for the trade press. From what I've seen in my career, people that fit this mold generally fall into one of two buckets:
* People who try to make up for their lack of technical ability by worshiping researchers (like Dowd) and developers (like Fyodor).
* People who try to make their lack of technical ability seem irrelevant by tearing down other people.
Winkler has always been firmly in the latter bucket. If you want to talk about "things that set the computer security industry back three years", let's start with articles that conflate actual criminals (like the "Twitter hacker") with people who have chosen breaking systems as a research topic.