I'm highly skeptical of stories like this, although I didn't watch anything more than the clip above. They make for great fear mongering when you want to push a certain agenda, but I'd need more data. about 15 years ago there was a very similar story to this that caused a lot of consternation, except it was Russia and the target was a municipal water system in Illinois:
https://www.reuters.com/article/markets/u-s-probes-cyber-attack-on-water-system-idUSN1E7AH1QU/
It was all bullshit. The pump burned out and the 3rd party system integrator that the city hired to manage its controls was travelling in Russia. He got a call, so he logged in remotely to access the controls system so he could assess the situation, and the next thing you know it was all over the news that russia took an illinois water system offline. I sold control software for many years and actually talked to that integrator on the phone a few times when he was kicking the tires on some of our products to replace his homegrown software. It was a hilarious conversation once I found out he was the guy. When he got back to the states and saw the story blow up in the media, he actively contacted authorities as well as media companies that were promoting the russian cyberattack angle, and nobody wanted to believe him. He finally said fuck it, made sure the city officials were clear on what happened and stopped trying to correct the narrative. The FBI eventually begrudgingly determined Russia had nothing to do with it, but they fought that narrative for quite a while even when the integrator was telling them what happened.
Now 15 years of selling industrial control software into critical infrastructure installations and manufacturing companies has me terrified of what is possible if foreign actors really wanted to fuck with shit. The big size cities and billion dollar companies generally do a decent job of following vendor guidelines and implementing some sort of cyber security framework. The smaller cities and municipalities cant afford full time controls engineers so they outsource everything and commonly dont pay for annual support agreements so their controls software isnt patched and vulnerable as shit. You wouldn't believe how many times I was given remote access credentials to look at a software issue on a system I had no business being given access to. I would tell these people DO NOT GIVE OUT YOUR PASSWORDS, and they would answer, but you work for the vendor, we can trust you. There are also huge numbers of wireless access/connectivity solutions on lift stations, remote control panels, etc... that are using default passwords or no passwords. It further convinces me that there arent a lot of people trying to bring shit down, because if there were, it wouldn't be too fucking hard.