The San Francisco transit system avoided paying a ransom and restored its systems. But the hack shows US infrastructure is vulnerable.