Because the problem is critical infrastructure with holes in it, not that someone might communicate with that infrastructure. Trying to change the environment to ensure there are no attackers on the net is not a feasible alternative to hardening the critical systems.