The problem is you are assuming you can do that. Not everything is connected to the internet, and there are backups. You can probably shutdown power for a couple days (and a couple more weeks to be back up to full power), but you can only pull that trick once or twice before they start taking action. It isn't hard to disconnect internet cables (shut down all internet and force the operators to use personal cell phones...).

Likewise, water processing is mostly pumps. Even better, any competent town has backup generators and they keep a few days of fuel on hand, so even if you get the grid down there is water, and the system can function without internet.

That isn't to say you can't annoy life for everyone. However state collapse won't happen because of that. More likely you firm up the resolve to fight.

That stuff is so distributed and so heterogenous that I just don't think a successful attack of that sort is likely.

Edit: Maybe the most sophisticated attack of that sort was the one against the Iranian nuclear program, and while it was successful it and seems to have set back the program it was hardly a show stopper. It also required pretty specialized knowledge of the controllers used to operate the centrifuges (for enriching the fuel). If you consider the enormous variety of controllers and ways of doing things across different plants I just don't see how it would work to shut down a large fraction of even something like power generation.

I suppose, I just have a feeling that the most powerful capabilities of cyber super powers are yet to be seen.