We know that a lot of our critical infrastructure is vulnerable, as this article again shows. This may have been "the norm" for decades but this has to be fixed. Unfortunately it often takes a catastrophe for things to be fixed.

At least here there was no catastrophe but still enough noise at a sensitive enough time that, again, I am sure that those systems will be upgraded.

Also, we're discussing securing infrastructure against threats up to state actors. They don't care about harsh penalties unless these are painful counter-attacks.