Us Nsa Alleged to Have Launched a Cyber Attack on Chinese Timekeeping Agency

I suspect part of it is that society still sees 'cyberspace' as unreal, outside its purview, an intangible place, a sort-of wild west where anything goes (I'm struggling to find one or two words ...). Look at how society deals with the massive fraud that takes place on the Internet - is there a huge public reaction, a massive FBI task force, new laws, etc. The government is sending troops into cities for mythical dangers but it's still mostly hands-off the Internet. Therefore, attacks via cyberspace may seem equally unreal, etc.

Also, there is no physical presence on the enemy territory. But there is that concept again - it's not physical, it's not real.

Another issue may be that, more than almost anything but annihilation, international relations professionals fear cycles of escalation. They have many times easily and quickly spiraled out of control - out of leaders' control - and led to the worst possible outcome, warfare (and even worse, warfare in places and times and by means you don't choose). People still don't understand how to conceive of cyberspace (consider Trump's and Putin's personal grasps of IT - they are not on HN), and there are few norms or rules to follow.

There's also spying, which has long been accepted. Spying via cyberspace may be completely valid on that basis. Sabotage is just a step past it, but most actions such as the OP are preparing for sabotage, perhaps in case of warfare.

Finally, a major concept in modern international relations is 'grey zone' conflict: Conflict and actions short of warfare, which can acheive some ends, undermine the international rules-based order (if that's what you seek), and prepare the ground in case of actual warfare. Examples include China's 'fishing boats' and 'coast guard' physically assaulting civilian boats in the South China Sea by ramming, using water cannon (notice: no shots fired), in order to control territory; Russia's actions before invading Ukraine outright; and I'm sure we can find plenty more.

Personally I think if one of these cyber attacks either hit a large/important enough civilian target, like shutting down a power grid for days, or a reasonably important military target, like a helicopter midair or something, then escalation might happen, but hard to say