Purely anecdotal but earlier this year I had presentations from a couple of installers for industrial control systems for buildings and I was thoroughly disappointed.

TLDR multiple of the installers just wanted to have a public static IP address, and just drop the control systems directly on the internet. None of them knew who was responsible for device updates or CVE's. One of them had an optional proprietary yubikey type thing with no idea how it actually worked. One companies security assurances was basically they always do this and have never had a problem before.

Don't get me wrong, I'm all for beyond-corp, but none of the companies we talked to seemed knowledgeable enough to risk it.

Just some insight into how the rest of the world operates, I would expect bigger companies to have more resources, but this is an example of what happens when you're small and dealing with "experts".