Employees can be a threat, yes. Ideally, the ports to connect data should be non standard - or just glued shut. Or have no employee!

The problem with stuxnet was that non dedicated thumbdrive brought in the worm. Also their equipment was networked. Bad idea. If data must be exchanged, use unidirectional links. Good old serial ports, with only TX or RX wired (Edit: I do not think centrifuges need a full ethernet stack. Depending on high level abstractions like TCP/IP for simple operations comes at a cost)

My model is not perfect safety, but if it take something the scale of stuxnet to attack, I feel safe enough.

I laughed when the recent spectre and meltdown exploits were revealed, because the good old airgap model meant I did not have to care.

Yes, I'm sure it's practical to manage thousands of centrifuges without networking.

It's a SCADA system coordinating thousands of centrifuges, if it's not networked you may as well turn it off!