It is 100% looney to have critical systems being controlled remotely. I’m all for a read-only report remotely (i.e. making sure tings are working smoothly).
I think that this is sold as “remote updates” - changing the software without sending people around. Once you can do that, you can do anything.
I also expect that the refrigerators in Europe said that, “Everything is Fine!”, while the food spoiled.
Unfortunately, organizations expose their systems to the internet (or other forms of communications access) as a trade-off for the exact thing this article is warning about.
If you cannot monitor and control systems remotely, it means you will have to respond physically, and if there are no qualified personnel on site, then you are adding a lot of latency to your response times.
In other words, these systems are exposed to attack BECAUSE organizations want to reduce production down time.
Part of this is the fault of not paying for manpower though. Why would you want to pay a technician to be on site at all times at some remote sub-station, or have to wait while one travels to it, when you could just build in systems for remotely monitoring, rerouting, restoring/rebooting your systems from a central location?