It's wider than this. A "person of interest" will be attacked either way. A "normal boring person" won't be targeted directly, but may be swept up in an attack on a "person of interest".
But there's a third case: "normal boring people" become interesting just by being together in a big group, even if no particular "person of interest" is among them.
If you're a "person of interest", you'll be attacked either way.
If you're just a regular person, like me, you won't likely be targeted. But my chances of getting a collateral damage are much higher in a centralized system: when it's broken into, my data have a chance of being siphoned off along with data of someone less ordinary, who was the target of the attack.