[jamesmotherway]

I'm assuming by "significant" you mean an attack on critical infrastructure.

That's a strategic capability that very likely requires multiple attack chains, not a single exploit. For Western countries, cost is probably the least significant factor in deciding to use it.

One would want to be certain that option is available, but only when absolutely necessary. Using it on a random Tuesday would take that particular option off the table forever. Best case scenario, Russia discovers the means by which the attack was carried out. Worst case, they retaliate with nuclear weapons.

Globally, I believe there are only a few countries capable of executing such a plan.