The problem is you are assuming you can do that. Not everything is connected to the internet, and there are backups. You can probably shutdown power for a couple days (and a couple more weeks to be back up to full power), but you can only pull that trick once or twice before they start taking action. It isn't hard to disconnect internet cables (shut down all internet and force the operators to use personal cell phones...).
Likewise, water processing is mostly pumps. Even better, any competent town has backup generators and they keep a few days of fuel on hand, so even if you get the grid down there is water, and the system can function without internet.
That isn't to say you can't annoy life for everyone. However state collapse won't happen because of that. More likely you firm up the resolve to fight.
That stuff is so distributed and so heterogenous that I just don't think a successful attack of that sort is likely.
Edit: Maybe the most sophisticated attack of that sort was the one against the Iranian nuclear program, and while it was successful it and seems to have set back the program it was hardly a show stopper. It also required pretty specialized knowledge of the controllers used to operate the centrifuges (for enriching the fuel). If you consider the enormous variety of controllers and ways of doing things across different plants I just don't see how it would work to shut down a large fraction of even something like power generation.
That talks about poisoning hundreds of people, which would be a tragedy, but not all that unusual for a war. Hundreds of people dying is hardly going to decide a war.
Edit: My point isn't that cyberattacks can't cause real damage. They can and there are many examples of them doing that already. My point is that they aren't enough to win a war because they are by their nature specialized and restricted in scope.
