I guess for nation-state it could end up in a MAD-like scenario. "Because offence is so far ahead of defence, you know we could shut down your power grid if it struck our fancy, and we know you could do the same to us. So how about we all stick to a smaller, tactical-level cyber-ops and call it a day?"