On the contrary - this is explicitly the mission of most military organizations. There are countries in the world today where every day their bridges and buildings face adversarial attacks from state level threat actors.

The difference is, people who build civilian bridges and buildings are not actually generally expected to build structures that can withstand such attacks because preventing those attacks is considered the government’s job.

So no, they typically don’t undergo ‘more rigorous testing’ than software against security threats. The fact that governments make no effort to protect networked systems from being attacked places the burden of withstanding those attacks fully on the private civilian operators.