And let's not forget the premise is all wrong as well.
It's frightening how easy it is for an foreign actor to knock out a country's railway system
The attack on SNCF was not "easy". This was a methodical, large scale, coordinated attack. They knew what to take down. How to take it down with least collateral damage. And when each should be taken down. (Order likely counts here. You're trying to plug up tracks.) Point being, these attacks are not "easy". In a place with as much unrest and discontent as France has bubbling beneath the surface, the trains would go down twice weekly, every week, if it was "easy" to do so.
A similar methodical, large scale, coordinated attack on our bridges would shut the system down as well. I won't even mention some other infrastructural assets that, if targeted, easily will shut us down for months because I think they are just that soft as targets. I honestly believe it would be irresponsible to even put the idea out into the ether.
The takeaway here is that if you're dealing with large organizations, with even a modest amount of resources, and a grievance, you're likely dealing with orgs that have a lot of young people they can send to successfully carry out such attacks. Thankfully, these attacks still require a level of technical knowledge that seems to elude such groups. So it's just matter of keeping that information as secure as possible on the one hand. While working towards security and resilience of those assets on the other.