In my opinion, typical PoC academic work tends to underestimate the actual effort required to execute an exploit, and sometimes even describes exploits that can only ever occur under very stringent conditions.

Didn't Stuxnet involve backdooring Siemens PLCs? I find that pretty remarkable. In general, extremely sophisticated exploits that target critical infrastructure require attacks that haven't already been considered, be it for delivery or execution.