One of the oldest tricks in the (SIGINT) book is to trick the enemy into activating their radar and/or trigger a response to an incursion to collect all of the resulting signals intelligence.
It’s alarming many leaped to suggest LEO satellites obviate the need for balloons/drones/spy planes because it really isn’t true; there are some things for which a proper resolution and capture is simply only possibly with proximity, at least more than a satellite has. In fact that’s why we still use U-2 spy planes (upgraded) and did for the balloon.
Given the number of unidentified drone/balloon incursions reported by the Pentagon in the last few years near ships and air force bases I do wonder what’s been exposed about our radars and or datalinks. It also doesn’t necessarily matter that the data is encrypted (a weird refrain I saw) because the operating frequencies and behavior of the emitters on our aircraft, ships is in and of itself valuable information.
I’m sure that NORAD doesn’t use their most advanced sensor platforms in such a circumstance, but there could be all kinds of interesting close range data to collect on the aircraft and weapons systems used to respond.