Security vulnerability on U.S. trains – known for 13 years (tomshardware.com)

Whilst its not uncommon for vulnerabilities to be known for a long time without being fixed, this is one that sounds like it should be fixed.

It is noted that the vulnerability hasn't supposedly ever been exploited in real life.

Apart from a targeted attack on multiple trains it does sound like this attacks likelihood is fairly low.

Ha, I was once tasked to do this for Russian trains. Thing is that they often loose the rear ends somewhere, and don't recognize it. They might be kilometers long. You need to able to detect that, and then optionally issue a break to the end. Of the course the message protocol needs to secure.