A water pump cannot carry Stuxnet.... but the Variable frequency drive (VFD) that runs the motor which runs the pump in theory could host malware within the drive's firmware. Or perhaps the VFD was interdicted and had some custom hardware installed? This is all assuming that it's a variable speed pump and not a fixed speed, in which case it's basically directly wired to line voltage with big electrical switch for on/off control.

VFDs are connected to the process control system through a variety of interfaces... simple voltage or current loops, serial buses like BACnet, modbus, or ethernet interfaces like modbus TCP.