In this context, "winning" means "not getting breached". I leave it up to you to decide why it might be valuable. I believe the author's point is that would-be

In this context, "winning" means "not getting breached". I leave it up to you to decide why it might be valuable. I believe the author's point is that would-be attackers are in essence economic actors. They seek some gain from compromising a system. If the cost in time, energy, money, or other resources exceeds the anticipated gains, then the attacker will tend to move on to seek easier targets. You're absolutely right. You don't have any interest whatsoever in the attacker's payoff being small. You may have an interest in keeping it lower than the cost of compromising your systems, but only to the extent that you actually value winning. If you don't value "winning", then you you can definitely guarantee that the costs to you will be small!