It's interesting to compare this to the physical-world analog. What if somebody shows up at the US-Canada border, start shooting rockets at Canada, and the US refuses to acknowledge this as a crime or extradite? What if the rockets are aimed at a critical piece of infrastructure near the border and can cause billions in damage? One could argue that if the US condones these attacks, they have effectively already declared war on Canada.

Well that's the main issue, currently the states do not consider such cyberattacks the equivalent of sending troops or rockets across the border that justify a "kinetic" response but rather the equivalent of earlier espionage activities which usually justifies only a diplomatic response. Of course, that might change in the future.

More like, don’t harbor or foster attacks on critical infrastructure or we will take action to bring those that do to justice. At what point do those actions by other countries become acts of war?