If the attacker doesn't declare war and the defender doesn't respond by going to war then the blunt answer seems like it'd have to be a no.
One would need to dig deeper to get a really informed opinion. I do believe Russia to be able and willing to do that, I do believe the so-called "Western intelligence agencies" to blame any malware on Russia or China on the flimsiest evidences.
There is also the possibility that the same tools were used both by the GRU and Russian criminals, leading to a misleading identification. Black hats would totally take someone else's malware and modify it for their purpose while still hiding their tracks.
Zero days are expensive to get but once they are exploits in the wild, they are anyone's to use.
So, even if in the infosec world you can never say never, but just as Stuxnet is generally attributed to Israel/USA, in the same way NotPetya is attributed to Russia, even though none of these countries will ever admit they actually did it.
I don't think that is right. You don't decide to be a criminal, you decide to perform an action, you get labelled then by others.
Some people want to destroy big businesses, they can possibly make as much money as they need already.
Of course you can make money through a side-channel that's less traceable too.
Note that it could make sense to a pro-Russia Ukranian group to extort money abroad and to hurt economically on the target. That seems to be the Russian MO to not be directly implicated in the Ukrainian operations: help with tools, weapons and money the groups that are already in place.
They give up direct control over the actions in exchange of deniability.
So it was targeted at the Ukraine, but plenty of multinational companies also operate there, so they were collateral damage
There are a ton of security experts who have indeed dug deeper, and came to the conclusion that it was Russia.
I have seen US TLAs blame China on really laughable evidences (and fail to do it properly on the one undeniable attack they did on GitHub)