I think this is a good point. Messing with oil is probably the fastest way to bring the full weight of the US gov to bear upon you.
That is an incredible understatement. Disrupting key infrastructure would be considered an act of war if it was done by a state actor. I'm not sure what the equivalent characterization would be for a non-state actor.
I do realize that in this case, as reported, the hack involved the IT systems and not the operational systems but I think my point still stands.
Not an easy place to be.