Well, I'm not justifying their actions by any means, I guess I should have made that clear. I'm just saying to take it as a good learning experience. You've now learned from a massive mistake as being an internet real estate holder.
Sure, we can come up with countless amounts of analogies if we want.. but we all know what they're doing isn't right, so it's kind of pointless. The fact that these exist more than someone breaking into your house and robbing you is because of the lovely anonymity of the internet. They can get away with it, and they know it. There's a far greater risk by breaking into someones house.
Leaving xss vulnerabilities in your sites is more than just having a bad lock on your door. It's leaving your door wide open with a HUGE sign above your house that says, "Hey, I am not home right now and I have thousands of dollars worth of crap you can come take."
Again, I'm not justifying these actions.. I've had my site defaced once years ago, and I felt extremely violated, as any normal person would. It is a sad thing that they get away with doing this, but because of them I run my sites with extreme caution and security. I took it as a learning curve, it wasn't as bad as it potentially could have been and for that I was thankful.