One reason I can guess: measured response (or more) against adversarial actions. Like when someone blows up something of yours so you hit something of theirs. We know that many state agents - and others - are conducting offensive cyber operations against the US, and it may be that defence is not enough.