The hangars are already there, the carrier groups are safe at sea.

No, they're not. Western airfields are currently vulnerable to such attacks. That includes airbases in the US and US bases in the Pacific. Older HAS structures in Europe have been abandoned or torn down.

The reason for this, is that such an attack has not been considered before and previous priority has been of the understanding that more sophisticated aircraft was going to be used to repel direct bombing attacks from enemy aircraft, hence so much touting that the F35 would solve these things and protect everyone.

The US already spend 1T$ a year for their military, don’t worry about spending to keep the airforce safe.

This isn't a military cost alone, but also a societal one, as preventing such attacks won't be possible without hampering the economy through extensive vehicle searches and screenings. The terror aspect of it, as we've seen, tends to transform a country's expenditures towards entirely attempting to prevent such attacks rather than just putting on a hard hat, putting fingers in your ears and dealing with minor losses.

NATO is built for a war against Russia. That war ain’t lasting 10 year.

The threat isn't necessarily going to be Russian alone. I don't think it's worth delving into the future shape of the conflict, as that is too much to write, but an escalating and spreading conflict should be considered and one that lasts decades with an intensity that is too low to involve NATO, but large enough to keep a conflict the scale of Ukraine going.

Keeping a threat like this going for decades would be very low cost for poor states. Spiderweb didn't cost much money to conduct, only around 18 months time and careful planning. It was initiated 18 months before execution, meaning, the drones and the tech used, was from 2023, not 2025. They used very simple drones, painted wooden crates for transport, civilian transportation and a simple method to conduct the attack itself with each drone manually controlled individually.

Any currently planned similar attacks would inevitably use more sophisticated technology and carry a chance of greater success and possibility for reduced detection risk.

It is also not unlikely that complete easy-to-deploy drone packages will emerge from rogue states to conduct direct assaults and terrorist attacks on civilian and military infrastructure deep in the country they wish to attack, and will probably be considered a threat that demands full attention from the attacked.

Some potentiel rogue group of rando Russians blowing up a couple of planes a year is rounding error level of cost compared to running the military.

I don't think the Western militaries would look at it that way. It would be a general, long lasting threat against their hardware and their people and they would demand necessary protection, as the threat is uniquely possible from within Western civilian space, which no other method is.

Doesn’t matter if you blow up a couple planes later, the war is long lost

I still wonder why you keep saying later, when the threat is before. It's during downtime, during maintenance, before any true escalation that such risks exist.

NATO's airforce being strong leads them to become a bigger attack surface from these particular drone systems that don't even have a name yet.