* You do not want to create an environment where some enjoy the protection of the FBI and others do not.
* You do not want to jeopardize an ongoing investigation or later trial.
Costs consist of writing and updating the malware itself, maintaining C&C servers and hiring mules to cash out the proceeds with an 8% commission.
Maybe there are kickbacks to government authorities, though I understand kickbacks are often payments in kind, by sharing exploits with intelligence agencies.
From what we've seen out of Russia, the militarization of hacking hasn't yet evolved to private armies - so either it's all being controlled by an existing (maybe the government) or early emergent (maybe a shiny new oligarch) player or the profit margins just aren't enough to justify violence. As soon as you can make 200k by robbing a criminal you'll see it happen though.
Consider that the attackers are in different countries that are beyond the reach of U.S. federal law enforcement. The machines they used to send the spam and remote into the victim systems are usually elsewhere. The money mules are and their corresponding banks are scattered across the U.S. and Europe. The victim's bank may or may not be located in the same place as the victim. And so on. Where did the crime take place? That's a monumental challenge for federal law enforcement, and frankly the local PD is just not up to it, especially when they're up to their eyeballs in fighting crimes (often violent ones) where their jurisdiction is quite clear.