When I worked in HMI/PLC land, the only real security I remember being done was network isolation. Web apps were still pretty new at the time. I can only recall

When I worked in HMI/PLC land, the only real security I remember being done was network isolation. Web apps were still pretty new at the time. I can only recall one project we did where a web app actually had any input to control (recipe scheduling). One client in particular required separation of PLCs that HMIs talked to vs PLCs that controlled the actual manuf equipment (robots et cetera). IIRC, only a select list of contractors were used to write code for the robots, whereas the HMI contractor list was less strict (group we were in).