Because twenty years ago computer security was an absolute and utter shambles. Exploiting a vulnerability today is orders of magnitude harder than it was twenty years ago. Massive strides have been made.

Just a couple years ago, the largest botnet in history infected IOT devices using default passwords in order to DDOS Minecraft servers, so perhaps these strides haven't been so massive.

IOT isn't datacenter server technology. IOT is basically in the state of software security from 20 years ago. Often running crappy proprietary stuff. Your average server running a recent Linux kernel is Fort Knox comparatively. There have been massive strides in many places in software security but IOT and embedded security in general is very lacking unless your talking things going into space or military.

The S in IOT stands for security, after all.

The S in Linux ditto.

Linux has a far wider attack surface than my baremetal embedded firmware. Like 10^6 wider. There's a single mqtts service mostly, or just passive senders (sensors, controllers). Zero attack surface.

Linux is way too big, with thousands of drivers, services and patches.

> Because twenty years ago computer security was an absolute and utter shambles. Exploiting a vulnerability today is orders of magnitude harder than it was twenty years ago. Massive strides have been made.

Yes but once an exploit is found it can be tried on a whole lot more systems and the weakest link becomes a target. There is also a lot more interest hence brains in hacking/ransomware.

I lot of critical systems should simply be airgapped

Vulnerabilities may have been easier but the scope for damage was reduced. Certainly in my organisation (local government housing) the impact even just five years ago of all our systems being unavailable was a lot less than it would be now (mainly because we've spent the last five to ten years getting people to abandon paper processes). More than this, we used to have various "systems" which weren't really connected together in a way that could be usefully exploited. We had hundreds of dialup modems in sites which were probably terribly insecure but all they were connected to was a single building component. Now, there's a management console (and related database) which gives you access to hundreds of sites over the internet.