I recall reading an article a year or two ago about this very topic. Their fundamental assertion was that utilities, and other industrial control systems are primarily SCADA. SCADA systems were never intended to be "networked". An instance may well have internal connections extending the geography, but it was a closed system overall. Then, along comes the Internet, and everybody just slaps a web interface on their product and calls it good. This leaves years of built up security issues that were never important enough to address, as the air gap protected them sufficiently. Things like hard coded support passwords from the vendor, little things, you know. Makes a lot of sense in an economics and general evolution of tech sort of way, terrifying in the actual outcome.
