Because it is speculation, with no special evidence. Could it be for just money? You can sell access to exploited systems in interesting companies for quite a bit of money. Or maybe it was for general use to twist public opinion in the future, not tied to those specific elections. Or just plain spying, We can't be sure, and the net was cast quite narrowly.

One could research where those repos are coming from, and do forensics on who controls the trojan network. But that wasn't done, so right now, it's all speculation. Something can be very worrying without us knowing exactly what the use cases for it will be

Why would they steal credentials when governments already have fake accounts for this exact purpose (see UK’s JTRIG from the Snowden documents)

… you also have to remember that the JTRIG leaked docs were about a decade before LLMs, so you could imagine tooling these days is 100x a they used to have

that things happen doesnt mean you do not need evidence 0xEF. No evidence was presented, so its speculation. It is _much_ more common to do other things than election tampering as desired effect of cyber activities. The amount of election tampering activities is statistically insignificant to other activities conducted in this domain.