I'm thinking of a nation state wishing to avoid a major diplomatic conflict. So I think it needs to stay low-level, legal or minor infractions only, and of course deniable. Also if it's hard to even notice something's being done, that's a real plus.

SCADA systems running public utilities plugged directly into winxp machines that are on the internet is something I have seen in person for 5 different organizations.

the CFAA and foreign states not wanting to start a war is seemingly the only thing stopping massive grid failure.

Heh, just take a walk around Shodan on interesting ports... the amount of infra that’s online screams criminal negligence

Major cities should probably be more worried about their own countrymen. If the "boogaloo" ever happens the power lines are probably gonna get shot on day 1.

The fact that it is criminal, possibly terrorism - prison or worse... might put people off too.

We're already talking in the context of: "subtly sabotage a large city in order to cause financial losses" so if it was beneficial in some way, I'm sure you could pay people off to do it for you. They'd either be aware it's illegal, (break this) or not (pee in this lake for $100).

The more people involved the greater the chance to get caught.

That only really affects the amount you'd need to pay to hire people. It doesn't change how hard it would be to sabotage the infrastructure.