There're different devices. You put online some but not the others.
Temperature sensor is a sensor. Refrigeration compressor motor is an actuator.
GPS positioning of a car is a sensor. Motor to turn the wheel is an actuator.
Aircraft altimeter is a sensor. Motors to control control surfaces are actuators.
And so on.
Sure, but as stated in reply to a sibling comment, you then just hack the read-only system to mis-report sensor state and interfere with operations that way instead. Or use one of a million other approaches. Attacks won't follow your rules.