Our current policy on retaliation for weapons of mass destruction is "A gas is a germ is an atom". Meaning we treat them all the same, and the opponent gets a thermonuclear dose of canned sunshine in response. We do not discriminate between chemical, biological or radiological/nuclear weapons.
How long before our resources are so crucial, that a policy becomes "A gas is a germ is an atom is an electron"? And not necessarily policy. There were very serious discussions amongst our Congresscritters about how do we respond to the Solarwinds/Solarigate/Nobelium/Hafnium attacks. So if we decide to respond to those (if we have not already) and Comrade Zi or Putin decide to mash a different button?
That is the thing that really scares me. The Ukraine was relieved of it's nuclear weapons and we assisted with this. Would Russia be making them their bitch if they still had nukes? Likely not.
I'm really, really going to watch out for the analysis of the attack on Colonial. If this was yet another ransomware attack that was similar to the attacks on healthcare and utilities for the last 18 months or so, I'm less worried. But if it was deliberately designed to go after the air-gapped SCADA systems as Tabsaco mentioned. A buddy wrote his master's thesis on STUXNET when he was at CMU when it was initially discovered. I still have a copy of his paper.
I got to talk to Andy Greenberg a while back, after he released his book called Sandworm. I'd definitely encourage my fellow nerds to read it.