Even if an organized adversary can reliably control whatever infrastructure they choose, it's still being institutionally treated as an unknown - otherwise it would be fixed.

I basically agree with everything you've written here, but saying it already "gave away" basically means giving up. Whereas this "cyberwar" meme is a call to action, and so I think it bears repeating that on the technical side the problems are extremely straightforward. Rather the real problems are organizational/institutional, and that's where blame needs to be directed - so that the call to action doesn't lead to further obtuse top-down measures like more procedure-bound certification-based consultants or a national firewall.

Worthwhile top-down things that could be done would be say a national bug bounty on any critical infrastructure (and indemnification for any incidental damaged "caused" by researchers, rightfully assigning it to plant operators instead), or perhaps even a wholesale repeal of the CFAA to stop papering over the fundamental nature of the Internet being hostile noise. Stop discouraging 12 year olds from playing around with infrastructure for the lulz, and make administrators have to deal with reality rather than continuing to ignore it.