Might be Lily was simply a lousy shot. The dozen or so bullets that hit Data and penetrated his clothing might also have penetrated his skin, but failed to do any internal damage; the rest just missed, which is what you usually get if you fire a light machine gun from the hip.After all, in First Contact, he was being fired at with a machine gun and he turns the woman who was trying to kill him with, "Greetings."
Having the one and only original Data appear alive and well again would actually be less implausible than having Lore reappear after "Datalore". Data was blown to space (and not necessarily to bits) inside a debris field inside a spatial anomaly; his body might have disappeared from sensors easily enough. Lore was transported to normal boring vacuum; sensors ought to have picked him up, and our heroes should then have rescued/apprehended him.
Of course, "Datalore" probably intended for Lore to be beamed out in a lethal manner. And the episode would be more consistent that way, too. Supposedly, the Crystalline Entity would attack the ship the very moment the shields were dropped and something was beamed out. Yet when Lore is beamed out, the CE just withdraws.
Was Lore delusional in thinking that the CE understood him and his plan? Never mind, the very act of dropping the shields should have caused the CE to attack, plan or no plan. So odds are that the shields were not dropped, and Lore was beamed against the shields and ceased to exist at that moment. Except that "Brothers" proves it didn't happen...
Timo Saloniemi