Do I understand (below) why Q = dP is easy while finding d is hard As we all know for discussion of Dual_EC_DBRG, the point on an elliptic curve Q can be calculated from P and some (large) integer d

$Q = dP$

And we know that knowledge of Q and P is not sufficient to be able to compute d efficiently.

My understanding

I've been hoping to explain why, and I believe that they answer is that when computing dP, one doesn't have to perform d - 1 additions, but instead can make use of the fact that you can calculate $\{2P, 4P, 8P, \dots, mP\}$ where m is the smallest power of 2 greater than or equal to $d/2$. That set of points can be calculated with $\left\lceil\log_2 d\right\rceil -1$ additions.  And then to compute $dP$ we will need an addition for every 1-bit in d.

So in worst case, computing $dP$ requires $2\log_2 d$ additions. But this short cut is not available for computing d from P and Q, and so the number of additions (subtractions) is closer to d itself.

Is this close to being a useful understanding?
Computing $d$ given $P$ and $Q$, with $Q = dP$ is known as the "elliptic curve discrete logarithm problem" and is considered to be infeasible under some hypothesis. The security of Elliptic Curves Cryptography is based exactly on the ability to compute the point multiplication and the intractability of the inverse operation: given two points find out the discrete operand $d$. The difficulty of the problem is given by the size of the elliptic curves.

One (of the best) algorithm to compute the discrete logarithm, Silver–Pohlig–Hellman algorithm, has complexity $O(\sqrt n)$ where $n$ is the order of the elliptic curve, but it is very efficient in the case of $n$ smooth (product of small integer). This is also the reason you don't want to have a curve with a smooth number as order. 

The first part of your question shows a standard way to compute the point multiplication using the binary expansion of the multiplicand. It is usually known as "double and add" and corresponds to the "square and multiply algorithm".

If you're trying to understand how the backdoor in the Dual_EC_DRBG works you should read this answer  to the question  Explaining weakness of Dual EC DRBG to wider audience?. Roughly the $P$ and $Q$ used in the standard are generated in an unknown way. So, if NSA knows the $d$ scalar such that $Q = dP$ they can compute some values and synchronize with the generator. If you implement the same algorithm using two (provable) random points, the backdoor disappears. Usually a provable way to generate a point is to hash some not random english strings (as the US Constitution or the Shakespear's work or the Star Wars The Force Awakens original script, or ...) and use this output to generate the point.