> Yet here we are in 2026 and these utilities are still connecting these things to the raw Internet with default passwords.

I work with PLCs. Default passwords of not, the idea that such weakly secure devices are being made accessible from the public internet boggles my mind.