The idea that capabilities are more important than strategy is based on not understanding how capabilities and strategy link together.
“It’s really important to have the capability first, because the capability is the options that you bring to the secretary of defense or to the president and national security advisor”
A set of capabilities are required in order to execute a strategy i.e. to colonize Mars you need the capability: interplanetary human and material transportation.
The article assumes that strategy and capability are not linked and that there is only one strategy.
In the case of Cyber buildup (or any significant undertaking) there are short, medium, and long term strategies with each requiring their own set of separate, linked, or evolving capabilities.
The capabilities of concern to the author are part of some short term critical strategy he is not articulating as immediate to short term offensive and defensive strategy which requires immediate to short term offensive and defensive capabilities. That turns on analysis of what is it that we are tying to achieve short term and how, where, who, when, why? Without that throwing hardware, software, R&D and personnel randomly at every perceived problem will be a waste of time, resources and will delay or hinder developing effective capabilities.