If they could have poisoned the water they would have done so. BTW, that's one of the reasons we have such elaborate municipal water works ~ to make the water safe.
I think al-Qaeda’s capable of neither now, but Iran could if they chose. It would be suicide, and still not have the propaganda value as nuclear missiles, so they don’t.
Water works security helps, but there are ways around it. If not water, public events. Fortunately, people willing to do this generally must also be inept in so many ways that they’re challenged to get it done and are relatively easy to disrupt.