The framework works just fine. But it is in the warmongers' interest to blur the lines - writing off acts of aggression as not war (yet somehow still not crime) hinders democratic oversight. Meanwhile propagandizing that we're in some continual low level war (just as in 1984) increases their status, lines their pockets, implies a need for wider society to
sacrifice, and justifies the use of a massive standing army for mercenary operations.
Framing remote bit twiddling itself as war is frankly ridiculous. Attempted exploits are the Internet's background radiation - its sine qua non is to cross jurisdictions!
If a hacking incident deliberately causes missiles to launch, or disables communication/defenses as a prelude to a physical attack, I'd call that an act of war. Anything short of this overt nature is simply negligence by someone not securing their systems before blithely hooking them up to the Internet, and then looking for an ominous scapegoat after they can't simply bust up some 12 year old's bedroom to soothe their own ego.
I do look forward to seeing if the snake oil industry starts backpeddling on all that state actor saber rattling, now that they will be getting hired to write reports justifying insurance coverage.