Attackers are not currently penalized.
They enjoy the privilege of choosing when and which outpost to attack, while the defender enjoys the privilege of home advantage.
Defender has to defend for 1 hour (therefore multiple attempts possible for attacker), while the attacker has to attack for 10 minutes (therefore if the defender loses the first engagement, he's probably lost the SAP).
Your logic dictates that if the defender isn't actively participating, he should be penalized by stability not increasing. Again, applying that logic to the entire equation would dictate that the attacker(s) should also be penalized for not actively participating.
And the only way to penalize the attacker for not actively participating would be with a monetary cost, which brings us full circle to Intrusion 1.0.