These networks should be air-gapped from the internet. Full fucking stop.

I know the largest local power company in my area has (had?) a completely separate fiber network for monitoring & WAN communications, because I helped design it.