It's not surprising that the system was using an unpatched OS. Many of these tools are not connected to the external internet, and they are qualified using the exact version of the software that is installed during delivery. I don't really know the details of foundry operations, but it seems like there are more incentives against installing windows updates than for it. Looking at your article it seems to say the same thing:

> patching is not always an easy endeavor in manufacturing environments because any code changes must be rigorously tested to ensure they don't have a real-world impact - for example on industrial control systems or supervisory control and data acquisition systems, which control the software and hardware that runs manufacturing processes. Indeed, ICS and SCADA systems may have a lifespan of 20 to 30 years. Many were never designed to be internet connected.