“…internet-exposed systems in the Water and Wastewater Systems (WWS) Sector, commonly via programmable logic controllers (PLCs) connected directly to a cellular modem.”

I’m guessing it’s not the cellular modem per se, but more so the assumption that the network is safe and non-adversarial. Which obviously isn’t the case. But having worked in the industrial controls industry, whoo boy, their software is a trusting bunch (less so these days, thankfully).