I'm assuming by "significant" you mean an attack on critical infrastructure.
That's a strategic capability that very likely requires multiple attack chains, not a single exploit. For Western countries, cost is probably the least significant factor in deciding to use it.
One would want to be certain that option is available, but only when absolutely necessary. Using it on a random Tuesday would take that particular option off the table forever. Best case scenario, Russia discovers the means by which the attack was carried out. Worst case, they retaliate with nuclear weapons.
Globally, I believe there are only a few countries capable of executing such a plan.
Hacking would just be tit-for-tat at most, and unlikely to be accepted as a good reason for major escalations. Most likely Russian infrastructure is just too old to be vulnerable in the same ways as Western infrastructure.
2 million USD gets you a smartphone zero-day*, according to rumours, something like a single ATACMS missile.
* geometric mean of 200k and 20M: https://techcrunch.com/2023/09/27/russian-zero-day-seller-of...