Most municipal infrastructure automation is run by SCADA systems. SCADA systems are designed to be closed ecosystems by default, which means they don't have access to the internet. Cables are run and point to point connections are made to transport these signals. If you've seen a big shiny aluminum box on the side of the road, that's a SCADA system.
Consumer demand has changed a lot since SCADA was first thought up. These days people want to be able to log into a portal and see their billed water usage by the day. Cities want to be able to turn off a meter remotely at the click of a button rather than rolling a truck. They want pressure loss, contaminate, and fault detection. They'd like to balance pressure in the water system dynamically. They want to perform detailed reports on total water loss, which means instrumenting pumps, retrieving telemetry data, auditing that data against every home usage, identifying faults, and producing a report out of it. All of these things don't work very well with closed ecosystems as they generally require a certain amount of external information. In response, cities have either crafted their own devices because they don't have the money to hire an integrator to design and produce them a device that will survive extreme weather conditions, be fault tolerant, make minimal use of power, and employ standard security measures or they hire an integrator. Even certain integrators can do shotty work.
The takeaway from this isn't that SCADA is bad or the infrastructure version of "the sky is falling!". It's that we desperately need to be thinking about how different generations of systems can be modularized and be built upon to minimize cost while maximizing security, capability growth, and reliability.
For the folks talking about "who tests what", I don't know what I can talk about in regards to specific programs but I feel confident that I can say that the FBI tracks this vigorously and works with companies that work in public infrastructure.