ISIS remember captured a large swathe of territory filled with assets. Some of these cities had banks, and all the contents were plundered by ISIS; likewise they robbed and taxed the local populations. They captured oil wells around Mosul and sold oil, and sold antiquities from historic sites. They used kidnapping for ransom and extortion, and recieved donations from global extremists. ISIS thus had an economy, income, and billions and billions of dollars to spend. The black market can then provide arms as easily as it does anything else, especially across borders that are as porous as those around the shattered and rebuilding Iraqi state.I meal look how long it took to really defeat the like of Daesh even for an army with supply lines etc vs an enemy in a known location using Guerrilla tactics.
Secondly, ISIS were in large part defeated by other militias with similar tactics such as the Kurds rather than by a modern, professional army.
Thirdly, with the need to hold territory in order to exploit it, ISIS were in many cases not operating as a guerrilla movement at all. The Battles of Mosul and Raqqa in 2016-17 were effectively full military operations storming heavily fortified cities.