See the last section (Afterword: removing the hat):

  First, in case this is not obvious to the reader, we do
  not actually endorse the attacker's perspective. Our goal
  in analyzing the security of systems is to prevent attacks.