Its where we keep the emergency reserves of Vegemite

To be fair to the threat actors here, if I was a foe of a country that could deploy Vegemite in anger, I would also want a strategic counter. That's barely short of haggis on the escalation ladder.

But n/m culinary weaponization... it seems like nobody knows how to put critical infrastructure online without these issues. Sometimes it's technical, sometimes social engineering, but it will get compromised. It's happened in so many countries and separate cases. There have been countless of these persistent threats in critical infra discovered in the USA too. What % did we even find? Were they completely removed? I doubt.

Feels like air gapping is the way to go. It isn't perfect, just ask Stuxnet, but it's waaaaaay more secure than dropping water and power systems onto the internet, no matter how careful.