It was quite scary when they started using SCADA to IP and exposing control systems to the internet.

I'm not so sure about that. Certainly they could do something, but anything truly harmful draws NATO into war with Russia. Maybe they want that? But if this is part of an escalation tactic to then use nuclear weapons, at that point, well it's pointless because you're now already in a committed war with no room for further escalation except nuclear weapons; now you've lost the threat component of the weapon and only have the weapon left, but so does your adversary.

The best card for Putin to play is the threat card. Without using nuclear weapons, or by using them first, he gains the escalation initiative which forces his adversary to respond with matching or further escalatory force, which is good when your adversary doesn't want to escalate. If you go all-in, well they're automatically all-in too. The problem with cyber attacks is you're likely to draw yourself into a full-blown war that conventionally you'll definitely lose, and now there's no escalatory room anymore - essentially it calls the nuclear bluff. If you were never going to use them, now you're at a war you're definitely losing. If you were going to use them, well, that is what it, and now everyone knows and can deal with reality as-is versus guessing at it and giving you (Putin) everything you want up to that threshold.