- The response can't have a blast radius
- Human software systems can't be formally verified in a tractable amount of time
- etc.
I'd go as far as to wager that if it weren't for MAD, the US might be sending SEAL or Special Forces teams in to deal with hackers.
When we have an AGI, perhaps it will develop systems impervious to intrusion. Or maybe it'll take the simpler approach and eradicate all humans and other capable AI actors.
This is expensive because it's guerrilla warfare.