But for "normal" industrial plants where there's a need for money to be made, there always will be a balance between IT security and pragmatism in running the d

But for "normal" industrial plants where there's a need for money to be made, there always will be a balance between IT security and pragmatism in running the damn thing. And those plants likely don't have enemies powerful or motivated enough to attack them in this way. Typical black hats these days are in it for the cash and I don't see how sabotaging a factory could be made into cost effective fraud.