I have said this multiple times. WHY are any critical systems internet facing?
They need to be on closed networks if any network at all.
I am happy for their to be monitoring connections so supervisors can watch values and settings. Or online warnings sent to people when things go wrong.
But it should not be possible to alter settings remotely in any way. We live in a time when no system that is internet facing is secure – not one. So why are governments still doing this?