On some podcast (Malicious Life?) I heard an interesting take on this. Short version: cyber war is not yet real war because attribution is too difficult to justify irl bombs.

So, if the barrier to entry in drone attacks is sufficiently low, could not a nation outsource some tactical operations to controllable private entities in order to obfuscate the origin of the attack? This, I would think, is plausible if the goal is to cause damage, rather than to demonstrate national prowess.

In this scenario, nukes would not be a sure deterrent.