Could someone please explain to me why critical infrastructure is even reachable by anyone not on a VPN owned by the infrastructure operators using 3+ factor au

Could someone please explain to me why critical infrastructure is even reachable by anyone not on a VPN owned by the infrastructure operators using 3+ factor authentication? And why are the source IP's not nullified internet wide and special forces going to the source ISP's to melt them into the ground? How is this even a thing?