I agree it's rarely followed. I don't think it's unrealistic. No one needed to connect water infrastructure or student data into the Internet, but we did, and the obvious thing happened.

https://www.bbc.com/news/articles/c934dq95zpgo

https://duckduckgo.com/?t=fpas&q=public+schools+ransomware&i...