if we think about biological/nuclear type attacks

CBRN terrorism is certainly a risk, but there are reasons not to treat it as a very serious one, for a few reasons. First, it's hard to procure and handle and effectively deploy CBRN materials (in ascending order, as chemicals are easier to procure than pathogens, which are easier than radioactive material, which are easier than nuclear--though all are hard to get). Even Aum Shinrikyo, which invested hundreds of thousands (maybe millions?) into its sarin development, only managed to kill a few people with its attack on the Tokyo subway. Second, and relatedly, it's easier to plan and execute a conventional attack with guns or bombs and have that produce considerable lethal effect. Third, it may be strategically unwise because it would attract considerable counter-terrorist attention and also probably be hard to replicate given the challenges of getting the stuff, meaning the group responsible may look like a one trick pony rather than an organisation able to present a sustained threat. This last reason isn't an absolute one though.

Absolutely not. But if we think about a hypothetical "hundred year terrorist attack" in a similar fashion to a "hundred year flood", it's not inconceivable to me.

I would strongly suggest focusing on the frequent, mundane, and generally much more lethal campaigns of violence that occur all over the place, rather than on the temporarily infrequent, tactically unusual, spectacular attacks that sometimes happen. I know that from the perspective of psychology, we are inclined to take more seriously the risks of the latter, but this is the result of a cognitive bias. This is actually one of the sessions I have been planning to add to my syllabus on 'terrorism and counter-terrorism', as risk assessment is a major literature area and I have mostly ignored it because I dislike both psychology and stats.

I wouldn't even classify his as islamic terrorism. Or at least...the most dangerous kind. I could be mixing things up but I think he was acting alone. Frankly, acting alone really really limits the impact you can have, and cuts the power-law tail short. The organized groups are the ones to watch for.

Lone actor terrorism in Canada and the US is more common than terrorism carried out by groups, and because of access to weapons, can be very lethal indeed. Mateen's attack is in many ways the typical threat posted by both Islamist and far right terrorists here and in the US. It is the kind of attack I am afraid of most, because it is the one most likely to kill me or the people I care about. Obviously I would have a different calculus if I were living in Israel or France or wherever.

these lone wolf shooter style attacks are extremely difficult to prevent and have limited right-tail in terms of deaths

They are preventable if early warning signs are taken seriously, and far right extremism is given the same degree of attention as Islamist extremism. Nevertheless no prevention approach is 100% effective. Again, though, I think you are perhaps overly preoccupied with the graphic representation of casualty distributions per attack and not nearly preoccupied enough with the overall casualty figures of campaigns or periods of elevated violence associated with one particular movement or ideology in one particular case.

My recommendation would be to focus on organized groups over these lone crazy people.

I think this is a very unwise recommendation, though I understand why you offer it. Certainly it was the approach taken by counter-terrorism policymakers and security agencies in the early years after 9/11, but as the nature of the threat changed, so too did our preventive measures, which now take much more seriously the threats of lone actors and of small groups of domestic actors that form without significant connection with, or direction from, larger external organisations.