You'd think that for something as vital as an electricity grid the companies would be using hardened systems with encrypted communication links.
A utility is a business operated for a profit. Corporations will take the path of least resistance to this profit, and since hardened systems are expensive to implement and manage, and since they have mostly been entirely unnecessary (no measurable ROI), they don't get implemented.
For similar reasons, most software has only the most rudimentary security needed to maintain the appearance of security.