Best practices have been and continue to be the lowest common denominator and an abysmal failure. Compliance solves nothing, and it is a make work project for compromised jobsworth consultants who lack the standing to tell anyone they told us so.
What I am arguing is tech and poor management culture in energy and infrastructure companies is the weak link that gave away the empire.
I basically agree with everything you've written here, but saying it already "gave away" basically means giving up. Whereas this "cyberwar" meme is a call to action, and so I think it bears repeating that on the technical side the problems are extremely straightforward. Rather the real problems are organizational/institutional, and that's where blame needs to be directed - so that the call to action doesn't lead to further obtuse top-down measures like more procedure-bound certification-based consultants or a national firewall.
Worthwhile top-down things that could be done would be say a national bug bounty on any critical infrastructure (and indemnification for any incidental damaged "caused" by researchers, rightfully assigning it to plant operators instead), or perhaps even a wholesale repeal of the CFAA to stop papering over the fundamental nature of the Internet being hostile noise. Stop discouraging 12 year olds from playing around with infrastructure for the lulz, and make administrators have to deal with reality rather than continuing to ignore it.
You're essentially arguing that the US is paralyzed due to the possibility of unknown unknowns. It might make sense to think that way to write a book, or for brainstorming large-scale disaster planning. But every system has someone responsible for it, and that someone needs to be responsible for securing it to best practices.
From a policy perspective, we wouldn't just accept that a power plant's energy handlers hum along unsupervised and so could fail catastrophically due to some latent problems. Rather, there are inspection and maintenance schedules to do the diligence of adhering to best practices. That same diligence needs to be brought to bear on a plant's information systems, and if those information systems are hooked up to a WAN (for which there may not be a choice), then that diligence needs to be applied to handling abstract adversarial attackers.
Not doing that is a grave failure, and what seems to be going on here is a "nobody's fault" because it's not in the plant administrators' or vendors' interest to look down and see that they're already past the edge of the cliff. But allowing it to persist is simply kicking the can down the road in an unsustainable manner.