It constantly horrifies me that they don't use data diodes for this systems like this.

Let data flow one way from the secure industrial equipment out to the general use network for monitoring, but you'd still have to go to a machine on the secure side to make any changes.