"run by two old guys who are plumbers, that's your average water plant"
https://www.nbcnews.com/tech/security/50000-security-disasters-waiting-happen-problem-americas-water-supplie-rcna1206
Some of that doesn't track.
First off, in California, if your water system is large enough to be considered a "community" system, people need some level of certification. Our system that serves 176 rate payers requires a Level III (out of 5 levels) tech to do most important stuff. The big problem is that a Level III takes a fair bit of study, apprenticeship and some rigorous tests, which makes these guys rare, which makes them expensive and run thin. But even so, our water system at that level is mostly manual. We do have chlorination, but the control is a manual knob that someone has to physically turn if, upon testing, the levels are off.
The one that's even smaller, the private system that's run by two retired plumbers, is also mostly manual.
As discussed before, I think it's the big systems run by professionals that are at risk. Those are the ones with all manner of automation, integration, remote access and all that. It may come to systems like ours, but almost all the components of our water system predate the internet.