Control systems are so ridiculously insecure given what they do. I was lucky enough to attend a DHS control systems security summit at INL way back in 2006 (or 2007 I can't remember). They had a huge lab full of various PLCs, etc, and a bunch of surprisingly smart folks working on pen-testing them. But still, it's a decade later and we don't seem to have made much progress.