It's much easier to call a company, impersonate a network administrator, and ask a user for a password than it is to attack the network.