They could do that, but for what current gain? In reaction to their attacks, we'd beef up our security—so if at some point in the future, they had an explicit goal, it would be much harder. Much better to not attack, let us keep our infrastructure vulnerable, so that when they need to attack, they can.
