>These systems are not accessible via the internet.

How would you know? Are you verifying them? SCADA systems weren't intended to be online, but that didn't stop critical infra for power plants, etc. to show up online. The convenience is too great to not try to remotely maintain them 'securely' & the assurance of airgaps is technical and expensive to get right.

Besides, are you considering the addition of modern AI to these 'offline' systems - factories, power, national weapons? You can get frontier models in a fraction of a rack today, who knows tomorrow. The organizations running these systems want in on the technological possibilities of AI, too.

Not to be a doomer about all this or anything, but there's a lot of evidence technologically superior entities dominate technologically inferior ones. So our home countries are in a Red Queen's Race to keep up, which is why adding "local" or "offline" AI to these systems seems probable. Again, airgaps are hard to maintain. It is within the realm of possibility that what's offline today is accidentally or intentionally networked tomorrow.

Yeah that's a fair point. Best practices and actual practices sadly don't seem to correlate that much in the real world.

As far as security is concerned, things like hospital equipment, traffic control signalling systems, weapons arsenals and bioengineering medical labs should not be connected to the internet and should be designed in such a way that a human is required in the loop at all times. And shouldn't use AI to function in any way.

But yeah, fair point that a lot of organisations will ignore that in favour of "look how easy internet access makes controlling this thing" or "AI is so cool", forgetting how badly it leaves them at the mercy of their enemies (AI or otherwise).