I do think you're broadly right -- the lack of immediate and obvious impact creates a perception that there is no impact. But even your first example -- data breaches -- does have an impact. It might not have happened to you, it might not have happened to me, but people do get their identities stolen, and recovering from that is a nightmare. And nobody is going to 'paper over' John Doe's missing retirement fund or ruined credit score, that harm is permanent.

> this never happened

This is also wrong. Russia has employed cyberwarfare against Ukraine multiple times -- e.g. in 2016 when they took large chunks of the grid for an hour, or more pointedly in 2022 when it was used to disrupt infrastructure and digital operations across the country as part of an invasion. Stuxnet and Triton were also pretty serious -- unlikely to kill millions, but they did have a real effect. If you're bringing this up to explain why people don't care as much as they should, then I agree -- but I would think that it's misguided to suggest that "this has never happened" actually implies that it never will. It took 20 years after the advent of commercial airlines for someone to bomb one, but clearly that is now a major and continuing concern.