It won't be MY city they are shelling, they cannot reach my city with their guns. Even if they could we are low down on the list of targets. However they can reach my city in a broad bring down all water systems attack. I suspect there are only a couple vendors of water control systems so if there is a hold in one vendor's water control system they will attack everyone at once. Tiny towns with < 500 people will be hit, and I don't know if my town is one or not. (actually tiny towns are probably easier to target, large cities probably have a mix of systems so they are more likely to get by with a general everyone conserve water message, whiel the small towns are down completely.
Many municipalities have sold off large chunks of their infrastructure to private companies that are always more concermed with profit than expenses like "security".
It stands to reason that the smaller towns will be hit the hardest since they're the least prepared for electronic warfare. Their IT department is going to be the same guy that tests the water and removes dead animals from the reservoir.