If only pathological cases of NP-hard problems are difficult to solve, then why isn't NP-hard defined to only include those pathological cases?
Generally speaking, for typical NP-complete problems, we don't have a good way to identify the computationally-intractable problems.  For instance, given an instance of SAT, we don't have any good methods to predict how long a SAT solver would take.  And for the most part we don't have anything that comes with any useful proofs.

So, in cryptography, we use cryptographic hardness assumptions, where the assumption does imply (in some sense) that we know which instances are computationally intractable.