> Criminals do more or less the same things that ordinary citizens do, and often have strictly worse security practices because they believe "ordinary" things are weaker
The null hypothesis is that criminals are humans like us, except that they make money through crime instead of legal employment. Fallacious reasoning here would require us to treat criminals as uniquely invisible or otherwise unlike other humans, which isn't really borne out.
This is a "survivor" bias fallacy.