Water systems haven't changed all that much since before the internet existed, let alone became popular. They still have broadly the same stages and generally the same things occur in them. There is literally no need for automation because it doesn't take many people to run a water system and they need surprisingly little training. It's a community college course! We implemented automation to reduce headcount, but if the automation systems are attacked and need work then that's actually increasing labor costs. Now you need to hire an engineer to fix what you should have done right the first time.
On the other hand, automation isn't even the problem, I only mention it to point out that these problems don't have to exist at all. You could solve the problem by not having remote control, or by not using the internet for that (there are other options) and by using one-way links for monitoring. Then you can still do your monitoring through the cheap and ubiquitous internet, and only have to use other resources for control.
Putting control of these systems on the internet gets you almost nothing and exposes you to risks which are completely unnecessary and doing so hardly saves you any money as you could use another option for your control links and it doesn't need to be high speed.