Operating air gapped networks is probably a new area of expertise for most people. It’s not hard to unplug cables, but people need access, updates need to be installed, results need to be extracted.

Also threat actors being on the inside breaking out is a bit new.