I would disagree with this. No petrochemical company I've worked with had OT/PLC/SCADA layers enabled for remote login. Other middle layers, like the historian, potentially. But not the control system itself.

It's possible to enable this but knowing the culture at Colonial Pipeline first-hand, I strongly doubt they did this during COVID.