I can go buy thousands of American phone numbers on Twilio right now, the only thing stopping me is my wallet.
There's no need to use twilio, the ecrime marketplace has this covered.
and the idea that the "attribution" is a driving concern also ignores the fact that, well, nobody cares. there is universal agreement of Russia's involvement in 2016 and there was virtually no cost to be paid.
I don't think there is. There's a lot of agreement that Russia (and others) tried to influence the 2016 election, but there's no agreement at all wrt how much influence they had. The same is true for Cambridge Analytica: widespread agreement that they did stuff, not quite as much agreement on how effective it was.