Many county websites go through companies that sell custom software. I don't know if this was one of them, but let's just assume that it is.

If they hack into one site using the software, they now know a) that vulnerability is exploitable and b) what software they can expect on the other side. Larger counties will have better hardware security and more monitoring, so it would be difficult to test the "hack".