It honestly doesn't surprise me that so many PLCs are exposed directly and are not up to date. Having worked in maintenance at a large factory where we directly worked with Siemens PLCs, nobody is really prepared to make their PLC secure. Most people handling and programming those PLCs do not have a deep understanding of "Internet of things" (in Germany, the term "Industrie 4.0" is used a lot) but management is happy to jump on that topic.

You usually don't worry about anything other than the task your PLC is supposed to perform (we're in a factory after all and need to make money, so better do it quick). I don't think I can remember ever updating the firmware of any of our PLCs, most of them even rot in a storage room for a couple of years before even being put in use.

Everything is connected to the local network for monitoring purposes and if it weren't for another department strictly managing our network I reckon there would be a lot more of them accessible directly from the internet.