The only thing surprising about this is that we don't hear about it tenfold more.
If you're someone who stands to gain from disrupting a nation's infrastructure... you don't tip your hand until it most benefits you.
If it really is the case that large parts of the infrastructure are very unsecure, expect to hear about it all at once, instead of little by little.
Meanwhile, we live in a world where VPNs are sold to the casual user while critical systems are left on internet facing networks.
I've never understood why, if these critical systems need remote access, it's not all done through a VPN of some sort. VPNs are not infallible, but it significantly increases the bar for entry from script kiddie to nation state real quick (depending on choice of crypt), while choosing a well supported implementation ensures long term bug fixes and security patches.
Maybe not at home, but couldn’t they have a local 802.11 network set up for this?
It would be sort of darkly amusing if we've done the same thing to other countries, and so time bombs in infrastructure essentially replace nuclear weapons as the guarantors of Mutually Assured Destruction.