Domestic attacks would be somewhat more difficult to carry out without being detected. It’s much easier for the Government to track domestic actors since there’s so much data collected on them both Nationally and by local law enforcement.
That’s why international attacks are more prevalent and bold: they’re not as easily traceable. However, that also comes with its downsides: if the USG wants, it might just use lethal force against you.
So ultimately the people who tend to do this repeatedly end up being state owned or state protected actors, who are likely offered some sort of protection by their State from retribution by the USG.