> if there are so many hydropower plans et al vulnerable for VNC, how come we didn't have some major catastrophe?

> And there is no shortage of people out there who would not think twice to blow things up.

From my observation, those people tend to be those that care more about doing "flashy" things (i.e. be seen), rather than solving problems and bypassing protections. People that get access to important systems or acquire the skills to mess things up tend to be satisfied by having solved a puzzle and being able to mess things up.