It's not really that big a deal to grasp the physical implications of code and timing. Any network code will have the same issue, i.e., any web coding.

The industrial controls industry has a very 1980s/1990s attitude for cybersecurity. I don't envy the public-facing engineers working for the vendors.