I think for the big players, it often is, my impression is the more systemic risk is smaller players (like very local utilities) these are sometimes run by very unserious people.

Most SCADA systems date from the 1970s and a lot of them don’t really think about network security or even have a concept of it. So, they don’t think about the consequences of connecting it to the Internet for remote access. It’s just a feature they want.