That doesn't mean it's not a ticking time bomb though.. I could understand this in very special legacy production situations with almost air-gapped security mitigations. Otherwise it's just laxness and a hack waiting to happen.

We have some Windows 95-era crap that's still there because it controls stuff that would cost millions to replace and the vendor is long out of business. But certainly nobody is "logging into it" as a side note. They're physically and logically isolated. You can do it if the risks are otherwise controlled but it should be the last resort and it's extremely impractical. You basically need a situation where every single network packet allowed to go in or out is dissected and validated. And I don't just mean at the protocol level.