1. They're mostly even more local. The Waymo Driver is in your car, the "driver" for say a DLR train is inside the train too. Unlike Waymo they aren't running multiple live feeds to remote oversight, even the emergency human intervention is literally on board with you. There's somebody wearing a uniform telling those tourists that no, Abbey Road is an outer suburb with a sewage pumping station, they're on the wrong train for the famous Beatles photograph. The person in the uniform is trained to drive the train if there's some reason the automation can't do it, nobody can do that from a control room miles away. In the even higher (and rare) GoA systems where nobody aboard can drive the train even if they need to, remote oversight still may need to dispatch a specialist to rescue a failed train.

2. They're mostly "grade separated" that is, they're either underground or suspended in the air, or maybe in fenced off ground-level areas, so you can't use a "hacked" train to hurt anybody except its passengers or maybe, in some cases, passengers on a nearby train.