Why Defenders Can’t Bet on One Model