What you see them doing isn't all that impressive. For the most part when you see these types of retaliatory attacks they look complicated but the reality is that they're fairly low tech.

For the casino hacks they brute forced some passwords and then wrote malware with Visual Basic to steal more credentials. The technical barriers there are fairly low. For the attacks on the water infrastructure they probably just scanned looking for open systems and ran off the shelf exploits on the ones that looked the most interesting.

Attacking in this way is a lot easier than attacking a specific target. If I just wanted to "hurt" a country from a PR perspective then there's a lot of attack surface, and you only need to get one or two things through to make the news. Targeting something like a secure nuclear facility is orders of magnitude more difficult.