That's a good question. I guess one response would be, how do we know there aren't repercussions? Wasn't an Iranian reactor hit with a cyber attack? I can't remember the specifics, but here is one result of a quick search:

From https://www.theguardian.com/world/2020/jul/05/satellite-image-raises-suspicions-of-atta...
"The Natanz site was first targeted in 2007 by a cyber-warfare campaign known as Olympic Games that included the use of the Stuxnet computer virus, which scrambled code and led to the destruction of at least hundreds of centrifuges, among other damage. Israel and the US were thought to be the architects of the operation."

So I don't think there's impunity, I just think this war is being fought in a less public sphere. It's far easier for governments to keep this war out of the press, unless of course it serves a purpose to have it in the press, in which case every government will choose to expose whatever event supports their cause.

But we live in increasingly interesting times. AI is going to be a nightmare in many respects.