The goal of an attack is not to do a standoff with the military and win. It is tocause a lot of damage quickly, to negate the feeling of security. Attacking next to the largest military base would be perfect for that, as it creates the appearance, that the military is unable to protect the people.
But the fact is that noone can really protect against this.
Some heavy truck driving through a crowd was often more efficient than gunmen throwing grenades.
Unless specifically searching for it, any semitruck will pass most police unnoticed and could be loaded with a couple tons of explosive fertilizer, enough to destroy a large buildung, killing hundreds of people.
And the attackers either include their death as a planned result, or they run quickly after an attack, making it impossible to respond immediately.