When it comes to SCADA systems they should never be connected to the internet and should be air gapped to prevent intrusions. If connecting from a remote location it should be secured with a VPN, 2fa and be read-only. SCADA systems are almost constantly monitored 24/7 and someone onsite should be able to handle any emergencies

Ooh I do security stuff.

I'm willing to bet that there are a core of talented systems engineers that built out the control systems for water plants. They are smart people that care deeply about what they do.

Their "leadership" however is usually made up of a loose group of interchangeable clowns that cycle in and out based on connections, nepotism and financial incentives. Their job is to do stuff to impress other important people and that usually means cutting costs. Sometimes it means getting into bed with a vendor or other company so they can profit from the relationship.

They will direct the engineers to use stupid shit, turn off controls, use platforms that are wholly inappropriate.

They will make a mess out of a system that was designed well to the point where fixing all the problems is impossibly expensive. They will declare that its good enough and then take their next job.

I have watched this cycle happen over and over. Current company has about 10+ years of problems stacked up and it would cost more to fix them than the company makes in revenue for a few years. They won't be fixed.