Yeah, sure. But burning a theater or a lone gunman mass shooting are completely plausible. It isn't your money, the people who own the theaters don't want to take the risk. Really that's the end of the story.
As for whether or not they did it, we know they have been actively building attack cells using resources and techniques they get feom Iran, and we know they were likely involved in the Aramco hack back in 2012 . And we know they could have made off with millions, they very literally owned the network, and they didn't, instead opting to embarrass the execs. I don't see why it is so far fetched.