They can, but its harder to take a lot of lives in either of those situations than it is if you have prep time in a hotel room. There is a limit to how many guns/ how big of guns you can carry into a public place without security taking notice (and I'll bet that there are discretely armed security staff at DTD and the hotels) and how many people you will take out before you are taken out. Suicide bombs are horrible, but they don't tend to kill a lot of people when detonated in an open area.
On the other hand, sitting in your hotel room shooting into the crowd at the pool - or into the MK bus stops from the Contemporary - its going to take security a while to figure out which room the shots are coming from and get to you - and that's what happened with Mandalay Bay. Likewise, with a staging area, its much easier to spend time planting explosive to detonate simultaneously throughout a building, which will create a much more severe situation than a single suicide bomber. Taking out a monorail could kill hundreds.
Here is the uncomfortable reality - Disney is a terrorist target - both foreign terrorists and the domestic nutcase find a magical happy crowded place with a corporate brand attractive. Disney has an obligation to do what they can both to protect their guests and their brand. No solution will be perfect, but if they don't check rooms and someone starts sniping guests swimming in SAB out of a Beach Club window, people will ask "why weren't they checking rooms after Mandalay Bay?"
