A. As an inexpensive way to communicate telemetry.
Back in the day, there were expensive EDI systems, but when internet access began to proliferate, a lot of utility information switched to the internet as a cheap way to move the data.
I will defer to anyone with current expertise; mine is from the early 1990’s in the Electric, Gas, and Water Utility industry, where I conducted research while working my way through law school. But my sense of it from back then was that it was the embedded systems, typically in electric transmission networks, that were almost completely unsecure.
These are long-lived assets; they get installed, and they may spend 20-30 years out there before they get replaced. If they have a flaw or a vulnerability when they are installed, it’s there until someone climbs the pole and replaces the hardware, out in the middle of nowhere. In a transmission system, it’s a huge logistical and financial problem.
Now, telemetry is one thing, control is another.
I do remote telemetry and control via Internet and Cellular all the time. None of my systems use web-based or publicly available protocols; and, none have been hacked. One technique that works well is a point-to-point callback to only predetermined IP or phone addresses. If I signal a site to connect, it originates a connection back to a prearranged address. It never processes an incoming connection or calls on an arbitrary connection.