This slowness also means it sometimes has a hard time understand new risks and a lot of industrial systems are not operated by people who understand those risks and do…very stupid things.

100%; I've worked on many a project that was implemented without proper concern for cybersecurity. It seems like this hack in France was triggered via a missed update (according to the manufacturer of the system, who I am hesitant to believe tbh). Security updates aren't always done automatically, and if a system's implemented by a consultant and the owners of said system don't know how to operate it, then you wind up with a bunch of spoiled food across however many supermarkets.

The best systems are implemented either in-house or by a team of consultants working hand-in-glove with the in-house IT or ops teams, then maintained in-house. That's been my experience. Unfortunately your average municipal wastewater plant is probably run on decades-old systems by the same IT dept. that fixes the city council's printer.