Even taking it at face value that most of these hackers are independent actors not a part of a state policy there would still be solid reasoning behind sanctions. That most cyber-attacks have a financial motive implies that sanctions are the best response; as it is hitting them in an area that the attackers are clearly interested in. As for those who are attacking for ‘patriotic’ reasons if they are truly patriots they will stop when they see their efforts are really harming their country not helping it.