It's beyond trivial to use proxies and malware to make it appear like your "call is coming from inside the house". It's beyond trivial to use more than one proxy, and/or Tor, where the overall mosaic and path will not be possible to assemble.
It is so trivial that it's often the plot of every movie or TV show on the subject. When Putin was asked this question once, that was actually his reply as well -- that "our hackers" can change their IP address easily, and all the evidence anyone may have on IP addresses is basically worthless. Yet we still let the politicians trick us into believing their intelligence services have any sort of irrefutable evidence of something that's often impossible to determine outside of using secondary factors that would often not be available in these cases that involve international borders?
---
Put it another way: for anyone to believe in these stories, you have to admit two directly contradicting assertions, (1), that the protection of these government systems was so good that only the best hackers of a single nation-state could have breached it, and, (2), that these best hackers of a single nation-state are so sloppy in their job that they never manage to hide their steps and shift any possible blame away from themselves.
In other words, I find it really hard to believe that these systems are properly secured, and if they are, I find it really hard to believe that people who could break them are so sloppy that they can't hide their true tracks.