Michael, It is obvious to me why hackers tend to attack low numbered ports. It is probability of success. Reserved port addresses tend to have known protocols associated with them, with known vulnerabilities - depending on the vendor or source code. These are the easiest points to break through.
Hackers live for success.
They can succeed more often with lower port numbers. So they use them. It takes a more serious effort to attack higher port numbers, because you are often hitting a complete unknown. These may be much bigger holes at times - in terms of information availability, openness of access, and spoofability. But the hacker needs to find the ports to try.