Buildings and bridges have very large safety margins, to account for design errors, construction errors, damage, poor materials, etc.

Airplanes have much smaller safety margins, meaning a lot more calculation is done, and there's a high emphasis on double checking everything.

Spacecraft have tiny safety margins, which amps up the design rigor to 11.

On the contrary - this is explicitly the mission of most military organizations. There are countries in the world today where every day their bridges and buildings face adversarial attacks from state level threat actors.

The difference is, people who build civilian bridges and buildings are not actually generally expected to build structures that can withstand such attacks because preventing those attacks is considered the government’s job.

So no, they typically don’t undergo ‘more rigorous testing’ than software against security threats. The fact that governments make no effort to protect networked systems from being attacked places the burden of withstanding those attacks fully on the private civilian operators.