These places are owned by many private companies, who might not understand the threats they face, or there is a culture where it is not a priority, plus there is no standard between these many companies, each has rolled their own solutions. Some might not be connected to the internet, but others are, there is a total mismatch between them. So, government has started to step in, by creating cybersecurity standards for infrastructure [1]. This will hopefully create a standard for everyone to start locking down their infrastructure in a consistent and reproducible way. This also plays into the moves to reduce data centers across the government [2], so they can create a standard, and hopefully reduce their security exposure.
And many are monopolies that have little incentive to prepare for black swans. They will just be bailed out or allowed to raise rates to clean up a catastrophe.
Tokyo Electric Power Company in Japan was allowed to borrow billions after their colossal failure at Fukushima. A failure that could have been avoided with better planning. But with no competition, what incentive was there?
[1] http://www.bloomberg.com/news/2013-02-13/obama-orders-cybers...
[2] http://articles.washingtonpost.com/2013-07-28/business/40859...