Sure, but that requires having a fully instrumented host get attacked. If all you have is a few reports of compromised machines, it's much harder to work backwards to the exploit. The attacker will switch things around before phishing again, etc...

Honeypots are harder than they look, basically.