You're right, but attacks that require supplies (especially supplies that aren't dual use, like guns) and coordination between many parties, are the types of attacks that the modern security apparatus is optimized for preventing.