Agreed, but it happens all the time. The IT department needs access to these systems remotely. They are usually on a LAN behind a firewall but they can still be compromised. Most of our nuclear plants have SCADA systems that are accessible on the internet and many of them still have the default passwords set on them.

Spend a few minutes searching https://www.shodan.io/ if you want to see how much crap is plugged into the internet. It's truly terrifying how vulnerable to this kind of attack we are across the world.