Electricity companies should be 100% air-gapped from any internet connection, whether or not they have outdated software.
There is plenty of room for antiquated process and technology in utilities that has nothing to do with grid operations, trust me. :)
You can do a one way link, sensors on infrastructure which emit data only but can not receive anything. Then another device like an ESP32 or whatever the industrial version is which reads the data and makes it available to the internet.
You now have the ability to remotely monitor the system but hacking it does not allow you to control anything. Though there is still a sizable amount of infrastructure which has no on site workers and needs to be remotely controlled.