You're arguing that there are no environments now where bad people can't penetrate and roam freely inside the local network? If so, I'm afraid I don't accept th

You're arguing that there are no environments now where bad people can't penetrate and roam freely inside the local network? If so, I'm afraid I don't accept that premise at all. Even a basic firewall that accepts no unsolicited incoming traffic is highly effective in environments where you don't need to serve anything to the public Internet from inside your LAN. Between that and keeping software like web browsers and email systems that actively fetch data from outside updated, an average household or small business will be protected reasonably well against most routine threats. The world is far bigger than cloud computing and IoT devices. There must be millions of little in-house web applications someone wrote long ago that are still useful, probably running on some 10-year-old PC in the corner, with some sort of scheduled back-ups if you're lucky. There is also no guarantee that even a high-value, long-lived engineering device manufactured a decade or more ago and still in perfect working order also still has ongoing software support. There is a huge amount of value locked into these old systems, and arbitrarily dismissing their relevance if they don't meet modern security standards that may or may not even be relevant in all the circumstances is like designing a building with such robust security that no-one can get inside, even the owners.