They’re still liable for paying taxes, which they do largely by mailing the IRS shoeboxes full of cash. By paying taxes they’re essentially admitting to a felony to the US government, which makes them trivially easy to raid.

That said, raids are relatively rare now due to executive order and the Oakland mess. In 2012 the DEA raided Oaksterdam [1] without properly notifying the Oakland PD, tying them up right as a local college was getting shot up [2]. It was a minor scandal that collapsed support for the DEA on the west coast and they haven’t done much cannabis enforcement since.

[1] https://en.m.wikipedia.org/wiki/Oaksterdam_University#Raid

[2] https://en.m.wikipedia.org/wiki/Oikos_University_shooting