Simply put, defense is hard. That's the main reason you've seen all of the national intelligence organizations playing hot potato with the issue. Hopefully this will be changing a bit for the better based on the executive order Obama signed recently that directs DHS, NSA and the FBI to expand their programs that share active threat information with private companies.
That said, the threat vectors for APTs aren't always solely network-based. IIRC, the behavior of the APT that struck RSA was fairly targeted and changed behavior once inside the network. It isn't unreasonable to think that the NSA would want to talk about putting sensors inside a private network where they could detect "successful" penetrations.
Again, we have every right to be wary of letting the (government) camel nose in the tent. I'm just saying that if you don't kinda sorta trust your government to help you fight a serious foreign power with nearly unlimited resources, you might need to reconsider your position. The threat from China is real and ongoing versus the theoretical threat from the US Government.
For example, the NYTimes has a bureau in Shanghai, and if they use a private contractor to help strengthen their networks, then I don't think that the Chinese government would be cancelling visas. If the NYTimes brought in the NSA, then I give the Chinese government five minutes before all of the visa get cancelled and the journalists get expelled.
The really sophisticated stuff is on the military side, which is a black box. But who is to say that the NSA or DOD is not actively engaged in trying to analyze or degrade the capabilities of Chinese APTs? It's possible someone in the NSA is reading the Mandiant report right now thinking "not bad, they got almost half of what we know."
The recent Obama executive order should help get more of such info into the hands of companies.
If you are a software company and you let it be known that you actively cooperate with the NSA and CIA, I doubt you'll be doing much business in China. I doubt France is going to let you in, either.
Outside of a few industries, the business losses from actively cooperating with a national government are going to be much larger than any losses due to hacking.
That said, our (USA) national interests are at stake here. So far, we've left it up to the individual commercial parties to police and defend their own networks and that isn't working as well as we would like.
I know that there was once a trial balloon floated to get the NSA to help commercial interests properly detect and defend their IT infrastructure. IIRC, the privacy interests considered that a bigger risk than the Chinese. I'm not sure that isn't a bit myopic.
When a company like RSA gets hacked, you need to think about the guy with a gun banging at your door, not the boogeyman under the bed.