>> compared to something like a fire or a flood

Those are not easy things. People litigate the difference between fire and flood damage all the time. (Putting out a fire normally involves lots of water.) Sometimes flooding in building X even causes a fire in building Y. Is that covered by "fire" or "flood" insurance? The difference between various cyber attacks isn't substantively more complicated than any of the traditional insured risks. The issue is that insurers haven't invested in the experts needed to properly assess those risks. That is their problem to solve, not the customer's.

Agreed with everything you said, though 'its their problem to solve' should they decide to offer cyberattack coverage and sell it, otherwise it is the customers.

If it's so hard to model then why are these insurance companies offering "cyberinsurance" in the first place?

Well a fire can do anything from cause a slight smell -- bread toaster or battery dropped in to a metal bin, maybe -- all the way to complete destruction of property and loss of lives, potentially ending the business. Seems relatively analogous in that respect to cyber attack?

Maybe I'm misunderstanding but aren't a fire and a cyberattack both capped at 100% of the value of the company? If the fire takes out the whole place, or a cyberattack empties out an equivalent amount from their bank accounts, the difference feels immaterial.

What if a fire spreads to other properties not owned by the insured or destroys things on company premises but not owned by the company?

Fair point, I was wrong to say 100% of the property value, though I imagine the upper bound of the damage is fairly comparable in both cyber attacks and physical attacks.

perhaps riot or vandalism [acts of civil disobedience]