I meant the web root - the "the main directory in which all the html is stored" and served as http://somesite.com/ , not the subfolders like http://somesite.com/grunt/

People who deface websites are mostly like opportunistic vermin - a particular way of hacking sites is used most not because it's cleverest, but because it's most widely available. Automated and well-known hacks are most widespread.