> In one of Sean Carroll's AMA's, he once said something along the lines of "entropy favors the attacker over the defender."

Eh, kinda. The defenders have the advantage of playing on the home turf. They know their infrastructure, can have sensors and traps everywhere. The bad guys are stumbling in the dark. They have no idea what's real and what's a honeypot, what signals you're watching, etc.

The problem is that almost no one takes this advantage seriously. If you're not paying attention to your infra, yeah, you're gonna get owned.