Even non-connected systems can be a problem. Stuxnet was an example. But I think the main point is that owners of those systems think they are protected just by being disconnected.
Yeah, and even the best security practices aren't going to work too well if someone drops a nuke on your facility.
Stuxnet was an extraordinarily sophisticated attack well beyond what a typical industrial system will need to protect against, or even be able to protect against. It's not really in the same league as anyone being able to just remote in and change settings, and while it's realistic to expect a bloke called Steve who runs the computers at the water processing plant to prevent someone just remoting in willy-nilly, it's not as realistic to expect him to defend against two nation-states working together explicitly targeting that facility.
And the target system also had security systems well beyond the capability of your local water treatment plant. Let's not forget that these assets deemed as critical infrastructure could be the target of nation states.
All I'm saying is that not being connected is only a small part of security for industrial systems, and that some people wrongly rely on it being enough.
As with this incident, operators were physically present. That seems to be the real lesson (even if - see other war stories on this thread - operators tend to themselves have a creative approach to network security).
The attack worked exactly as designed - wasting time, destoying equipment while being stealthy. Had the attack tried to destoroy all equipment at once" it would have beem spotted immediately.
My point is, physically-present operators did spot AN issue immediately. It wasn't properly attributed to malice for months, sure, but they could still mitigate during that time.
Without their presence, would you (as attacker) really bother with all the stealthiness? It certainly hasn't seemed to avoid long-term attribution. Set the controller to +INF RPM and let whoever pours over the logs in the morning spit out their coffee.
If it was airgapped it wouldn't be available to easily be used by a nation state to attack infrastructure in case of other simultaneous attacks.