It could do more harm than good, but it remains possible that someone will do it anyway. It's a legitimate scenario for these types of companies to consider in their cyber-security planning and preparation (assuming they have any).
Domestic attacks would be somewhat more difficult to carry out without being detected. It’s much easier for the Government to track domestic actors since there’s so much data collected on them both Nationally and by local law enforcement.
That’s why international attacks are more prevalent and bold: they’re not as easily traceable. However, that also comes with its downsides: if the USG wants, it might just use lethal force against you.
So ultimately the people who tend to do this repeatedly end up being state owned or state protected actors, who are likely offered some sort of protection by their State from retribution by the USG.
1/6 looked pretty easy. It also looked like it was pretty easy to catch the most gods-awfully expensive intelligence agencies in the world completely flat-footed.