The threat of retalition is historically one of the best defenses.

With big limitations that don't apply here. Things like mutually assured destruction work if/because an attack is quickly detectable, reasonably clearly attributable, and a symmetric tit-for-tat retaliation is plausible.

That's not the case for cyberattacks. Solarwinds was attacked many months before it was detected, Stuxnet was hidden for years. We have attributed some attacks but not most and attribution often succeeds only years after detection. And the attackers aren't as vulnerable to cyberattacks simply because their economy is "less connected" - for example, North Korea is at the extreme end of that scale and they really don't care much about what exploits you have; you have a digital economy that's wealthy but vulnerable to attacks by those who don't have it.