I recall reading about some pen-tester or white hat security tester who, when confronted with a physically isolated system, asked "How do you update it?" However updates were applied was the potential attack vector.
The power plant at Natantz in Iran was physically separate. Zero Day is a great documentary on that attack.
You mean the stuxnet attack?
Yep, that’s the one
Stuxnet also was a high-end targeted hack that had direct help from the power plant vendors. Big differences with other SCADA software.