It's not difficult to do OpSec - for the short term.  But invariably they're going to get lazy over time.  It takes a lot of self-discipline to maintain it over the long-term, and the longer you're successful, the more overconfident you become, which increases the chance you get sloppy.