The complexity of the malware has no bearing on the complexity of the operation. You could develop and test it completely independently which means absolutely

The complexity of the malware has no bearing on the complexity of the operation. You could develop and test it completely independently which means absolutely no risk to you or your key assets. You then could use expendable assets to get it into the network or more likely compromise a 3rd party like the Ukrainian engineering firm that worked on at least one of the enrichment projects and had its own computers infected by Stuxnet which is how it slipped out and started infecting other machines world wide. As for the malware itself it wasn’t as complex as you think but rather extremely well executed which is the best signature you have for western state sponsored origin. Stuxnet was a by the book sabotage operation, simple, safe and deniable it’s literally the classic example of an operational plan that will be greenlit immediately.