I see you don’t understand anywhere close the extent of the damage done. You should never know
It seems you don't understand my argument. Regardless of damage done, the penalty should be productive in some way, if possible. Harsh penalties as deterrents can be said to be productive, if they in fact deter. But if that is the purpose of the penalty, then the extent of the damage done shouldn't be relevant, only the potential extent should.
You don't have to be so creative to think of ways their lives can be made very difficult yet still enable them in some way to partially pay back.
If they develop a way to shut down DoS attacks of the type they developed and prevent further damages, the argument can be made that they fully repaid the damage they caused.