Attackers have time and budgetary constraints too.
Irrelevant. You cannot know their internality; all you can go on are their actions.
All you have to work with are someone's actions unless and until they choose to communicate with you otherwise.
And I've not been in school for decades; that was a repost from elsewhere - note the account names affixed to the text aren't me.