Is the controller really the place for putting in security measures? I would have assumed that they reside on a private internal network and it's the software l

Is the controller really the place for putting in security measures? I would have assumed that they reside on a private internal network and it's the software layer on top ( ie, a bacnet gateway or whatever) that needs to be fixed