Because you left an infected usb key or ten in the power station parking lot, the power of human curiosity, and the marginal cost of proactively protecting against something "very unlikely" by e.g. epoxying usb slots because procedure says it can't happen.

Because people still use USB drives to copy information to airgapped computers. It is easier than the alternatives.

Yes, they do. Yes, it easier. Yet, it completely undoes the "airgap" thing.

Security would be so much easier if it weren't for all these users ...

Your incredulity would be fully justified in the 1990s, but with every year that passes, it is becoming harder and harder to fully isolate computer systems from other computer systems. I'd like to think I wouldn't let untrusted devices near my power plant, but I have some sympathy for those who struggle to keep their stuff secure in a world where security is ever harder to achieve.

Because they are all connected in a IoT with MongoDB, React, and Node.js

/s

see https://en.wikipedia.org/wiki/Stuxnet