Electricity companies should be 100% air-gapped from any internet connection, whether or not they have outdated software.

So... how do you feel about apps[0] that let you automate pushing electricity to the grid from your own home battery based on wholesale electricity prices?

Nothing could possibly go wrong?!?...

[0] https://www.amber.com.au/

Air-gapping is a start.

Critical National Infrastructure should go further, as Iran found out with Stuxnet.

You can do a one way link, sensors on infrastructure which emit data only but can not receive anything. Then another device like an ESP32 or whatever the industrial version is which reads the data and makes it available to the internet.

You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.

There is plenty of room for antiquated process and technology in utilities that has nothing to do with grid operations, trust me. :)