Attacks targeting water systems just keep flowing across a dozen states, against ill-secured, Internet-exposed PLCs.