What are you “scoring” though. US firm loses data, has downtime, lost revenues, etc. If they attack back, what damages are they doing that they even care about? Seems to me they just are asking to be continually targeted.

Also, why burn the resources? Attacking isn’t free.

except this isn't a game of sports and a private company doesn't gain anything from attempting to "hack back" a foreign adversary. It just costs them resources and makes them an even larger target. And given that those adversaries are in all likelihood state sponsored the actual opponent is the US government, which is abdicating their responsibility.

It's like saying "the police doesn't care any more citizen, so you know just punch back". It's also incredibly dangerous btw to tell private firms they have the authority to engage in what is basically an act of warfare.

Can you elaborate on that?