Just two points:
- no, the defense of the city shouldn't be up to the players by themselves any more than training others' skills or giving out quests. The city isn't just the players, and the city exists even if most of the players are out or asleep. Going by what you want, every single player from the city who wasn't logged in could be spawned as an NPC to help defend the city, making it even more difficult;
- you're wanting to invade a city with a small group... read the underline a few times. It's not an outpost, it's not a backwater village. You're going against the best defense the city can muster to keep their citizens safe. From what I've read, that isn't in fact how retail was, so it's not a matter of "Blizz-like," just a design choice to make city invasions actually be more meaningful than what happens when a small group is bored.