They were never intended to be the only download point.
When the Cylons built their fleet, they had planned to wipe out humanity in a single decisive blow.‡ The resurrection ships were built primarily to support this one battle, and to act as an aid to the resurrection hub. Resurrection takes sufficient enough time that downloaded Cylons could not be expected to aid in the battle once they had died. As we saw in the episode Downloaded, they have the capability to buffer resurrections for a great deal of time. If they lost a ship in the initial battle, it would only delay resurrection until after their victory. In this context, they were disposable.
Things did not go as planned.
When the colonial fleet escaped, and the Cylons gave chase, they did not have the time or resources to build a new set of resurrection ships capable of withstanding a direct attack. Their hand was forced - they had to field the resurrection ships, as is, into the chase. Even then, it was not a tactically unsound move. The ship was guarded by other vessels, which made an attack by a single Battlestar a low risk proposition, especially since the Battlestar they were chasing was not seen to start many fights (Galactica had greater concerns guarding the fleet. Alone, it would have never sought to fight a couple of Basestars and the resurrection ship.) Nor did they have any reason to believe that the colonials had any knowledge of the resurrection ship. It was thought to be acceptable to allow the under-armored under-armed ship to remain in service in the field would be low risk.
Things did not go as planned.
The Galactica and the Pegasus meeting was something that could not have been planned for‡ nor would their knowledge of the existence of the ship, nor their willingness to attack it.
It was a tactical mistake for the ship to have been under-armored, but it is not illogical that it would have happened. The ship was never intended to be anywhere but the home system of the Cylons and the colonies.
An Aside
The defensive weapons a hospital ship carries are minimal. To quote the United States Naval War College (PDF link):
While it is clear that crews of hospital ships may be armed for their
own defense, GWS-Sea does not specify what are permissible weapons.
The accepted norm for arming medical personnel ashore has been "small
arms" such as pistols and rifles, and that norm was equally applied to
the crews of hospital ships. Traditionally, it was thought that
light, portable, individual weapons such as pistols and rifles were
all that was needed for personal defense on hospital ships.
Crew-served weapons, such as machine guns, were presumed to go beyond
the need for use in self-defense, given that belligerents were bound
to not attack hospital ships under the provisions of GWS-Sea.
Modern hospital ships, if there were attacked by a belligerent naval force, with guns and missiles, are totally defenseless. The weapons carried on USNS Mercy and USNS Comfort are pistols. This part of the analogy to a resurrection ship matches the facts - the resurrection ship had no weapons of consequence.
What does not hold is a lack of international convention that would make attacking a hospital ship an undesirable act. And even if such a convention existed, the colonials would be loath to define a resurrection ship as a hospital ship, as it would require defining cylons as life. In that point alone, the analogy falls apart, and is invalid.
‡ Six of the seven had intended this. The seventh had to pretend to intend this.
