“Will these attacks necessarily be net-delivered?”
Unfortunately, no, low-friction steps are relatively easy to outsource to people on the ground in much of America. Some might knowingly be involved in crime. Others are app dispatched workers doing not-obviously-criminal things.