I have a problem: It is just as easy to Hack and Slash at a goblin as it is to Hack and Slash the Apocalypse Dragon.
My proposed solution: A skill stat for NPCs. You subtract this from all Hack and Slash (and maybe Volley?) rolls against this NPC. This number does not go above 3, unless you are specifically trying to kill the players.
What do you think?