Yeah that's a fair point. Best practices and actual practices sadly don't seem to correlate that much in the real world.

As far as security is concerned, things like hospital equipment, traffic control signalling systems, weapons arsenals and bioengineering medical labs should not be connected to the internet and should be designed in such a way that a human is required in the loop at all times. And shouldn't use AI to function in any way.

But yeah, fair point that a lot of organisations will ignore that in favour of "look how easy internet access makes controlling this thing" or "AI is so cool", forgetting how badly it leaves them at the mercy of their enemies (AI or otherwise).