A thing you two aren't considering is the that US and the UK are the world leaders on the offensive side of this same technology, "we" just do a (slightly) better job of keeping this stuff contained. Raytheon, BAE, etc. all have cyber weapons development divisions and obviously GCHQ and NSA do their own internal development. The west's policy of "proportional response" will apply to cyber attacks as well.

Not that this is an excuse for having unpatched systems or not designing for the catastrophe scenario, but we should remember that this is a two-way street.