Russia could touch anyone in the US that they really wanted to, and vice versa. There is just this understanding that whatever you do, they are going to know it

Russia could touch anyone in the US that they really wanted to, and vice versa. There is just this understanding that whatever you do, they are going to know it was you most likely, and something is coming back. So Russia turning a blind eye to cybercriminals extorting the USA and others is their way at annoying the USA just as the USA does to them in various ways. But when that annoyance turns into something more than annoying, and verges on an act of war, there will be a response. That is why you don't really see foreign acts of assassination. Because other parties can do the same thing.