Because you don't have to pay for the long term mining equipment and instead can just rent them from AWS/GCP/Azure for the attack. If you did buy them though,

Because you don't have to pay for the long term mining equipment and instead can just rent them from AWS/GCP/Azure for the attack. If you did buy them though, you could attack cryptocurrencies one by one stealing money from a bunch of different ones. I think both situations would be more profitable.