What are you “scoring” though. US firm loses data, has downtime, lost revenues, etc. If they attack back, what damages are they doing that they even care about? Seems to me they just are asking to be continually targeted.

Also, why burn the resources? Attacking isn’t free.