On "hard" (and VH I assume) rebels can attack cities, on medium they don't. This is what the 1.2 readme said and my experiences with the game say the same.