Heh... Interesting that you bring in Rijkswaterstaat as a counterexample, because I remember it from the story about the Botlek bridge and how they could not fix it for a couple years and when the root cause was identified, it turned out to be rust in an ethernet port [1].

[1] https://berthub.eu/articles/posts/cyber-security-pre-war-rea...