Cargo ships get attacked & hijacked all the time. There exist some shipping lanes where such risks are well known. In fact, US Navy ships regularly patrol such shipping lanes in an effort to curtail or stop piracy. At the very least, many pirates are turned off by the prospect of facing off against a heavily armed Navy ship.

This isn't the same thing as retaliation. This is the US government deploying its considerable resources to mitigate an obvious vulnerability. Under international law, crews of merchant ships aren't allowed to carry weapons, leaving them defenseless against even the shabbiest of pirates. The navies - US and allied alike - are out there protecting ships that cannot legally defend themselves. Retaliation in this case would involve the American Navy sending landing parties ashore to Somalia, or attacking Somalian cargo ships in a tit-for-tat fashion.

Compare this with infosec vulnerabilities in the private sector. Are companies legally bound to stay vulnerable? No. Most choose to do so - consciously or not - because to date they've gotten away with a weak security posture. This is just the nature of business. An appropriate mitigation would be for Congress to pass legislation requiring companies to safeguard their systems. I would even go as far as commend the government for subsidizing infosec consultants for companies that are considered important for the continued functioning of society.

None of the above jives with retaliating in kind.