Maybe the CVE is being ignored because it's not such a big issue at all? It's already possible to cause a train to brake and make a disruption by pulling any of the emergency breaks inside it.