Civil projects are certainly over engineered because the life safety risks are clearly understood by all parties making the decisions. Unfortunately the "most of society" argument is clearly not true yet. Otherwise they would be springing the cash for proper IT and software security.
When talking about bridges, roads, buildings, tunnels, power grids and sewage pipelines - just to name a few - there is one additional factor that we should always consider.
Once made available, all of these will see constant use and they become part of the fabric of society. Taking parts of core infrastructure out to fix then has severe repercussions. Total cost of invasive maintenance will be a lot higher than the fairly simply calculated cost of on-site fixes.
I will gladly accept overengineering and nearly ludicrous safety margins.
