"Online," being operative term. The demo showed a standard vulnerable web app whose back-end provided access to the corporate network, which had a network link

"Online," being operative term. The demo showed a standard vulnerable web app whose back-end provided access to the corporate network, which had a network link to the HMI workstation, which controlled the PLCs that actuated the pumps. You didn't even need to do stuxnet level PLC code injection, you just logged in and worked the HMI. Not sure what kind of filters protect against this kind of thing, but a pH sensor with an alarm might mitigate the family level risk somewhat.