Which, incidentally, have been the target of a lot of recent high-profile attacks.[0][1][2][3]
[0] https://en.wikipedia.org/wiki/Duqu#Purpose
[1] https://en.wikipedia.org/wiki/Stuxnet#PLC_infection
[2] http://www.computerworld.com/article/2475789/cybercrime-hack...
[3] http://krebsonsecurity.com/2014/02/target-hackers-broke-in-v...
We do regular security audits from a security firm who goes the extra mile to try and social engineer and gain physical access to all of our sites.
Plus we're talking about things like processing fish in a town of 2,000 people. If I was operating a nuclear reactor, I would surely adapt better security measures.. although against government sponsored attacks using undocumented vulnerabilities, windows update isn't really going to do much.
The Target thing you posted has to do with internet access, which is something that goes against what I was saying. I'm talking about closed, physically secure networks, possibly not even using tcp/ip or ethernet.
Stuxnet-like attacks can go after non-networked equipment, but they're based on exploiting the computer with the programming suite, not the industrial system itself.