Took quite a few decades, if not centuries, for defensive capabilities to gain parity with/negate offensive ones after the introduction of gunpowder. I think the approach to cybersecurity thus far has been to try and protect against the projectile, instead of the instrument from which it's deployed. Buckle up.
The other big question is how much this stuff applies to defense. The US presumably has better defensive capabilities than Iran could hope to have, by far. But better enough to matter? Open question.