And at what point, after "cyber-damaging" some piece of critical infrastructure (and/or harming/killing people), does the the other side run out of exploits and just launch actual missiles instead?
What we are seeing now is a huge expansion of deniable and proxy warfare. Everyone is still (I hope) clear that sending an actual tank division across the Polish/Ukraine border would be met with nukes. So the question is, what is the largest most damaging attack that can be carried out without reprisal, and how do the participants find this out?
And of course, the ultimate in deniable attacks is one carried out by the enemy's own forces. Did cyberwarfare crash a US destroyer into a cargo ship? (Almost certainly not, but maybe next time). SWAT-ing is already established as a tactic; could suitably forged communications or "fake news" disseminated via the President lead to the SWAT-ing of a country? There are some suggestions that this applies to the Qatar situation.
Iraq comes to mind, although the forged information came from the invading country's own services.
Only if those tanks are under foreign flags. If they're under "rebel" flags, then nobody cares.