One other thing to consider regarding poisoning a well is that it can be done by one person. How much easier is it to sneak one person into a village or city than to try to invade it with a large force, especially if you are planning ahead and have it poisoned before you invade?

That might even sound familiar.

A small group having an easier time killing hundreds = recent attack in Mumbai proves that theory. History has hundreds of examples of these sorts of attacks and yet governments seem to refuse to listen to the historic lessons.
Planning ahead and poisoning the water supply before you invade = recent invasion of Georgia. The Russians actually launched cyber attacks against the Georgian infrastructure and took down their servers that controlled communication and infrastructure just before they invaded. Again, hundreds of times this has happened in history.