Nah, most of the time it's just a fancy infosec way of saying "it was likely ordinary criminals, or even some script kiddies, but it would be quite embarrassing to admit that".

Why don't they say "country"? Or just "nation"?

(Can it really be because "nation state" is more fancy?)

I can understand, though, why they don't say "state" -- maybe that'd sound as if a single state in the US had attacked

I think this derives from “state-sponsored”. “The state” has a distinct meaning from country or nation which I think is important to capture too.

I think your point about confusion with constituent states is spot on though

Thanks! Aha, so "state" here refers to the people running the country?

Rather than the citizens / "all people living there", (or geographical area)

So, could be organizations indirectly paid by, just an example, Putin or the CCP. But who the people in Russia or China don't know about (and might not have supported). -- I'm not a native speaker (I guess you've noticed :-))