Especially after the first one.

Internet connected can be useful in commercial environments. When designed properly it isn't a issue unless someone is really motivated.

The problem is the lack of a Firewall and network partitioning. The vendor was extremely sloppy in the design and security configuration which made it trivial to attack.

I hope they aren't, and we're seeing the failure of securing the network they're on.

Companies I've worked for keep different stuff on different networks, and to manage those things you either have to physically be connected to that network, or go through some kind of portal (secured with it's own credentials) then have credentials for the management systems.

I'd bet all the attacked systems are on a fairly flat network, and the control systems (servers and management devices) are poorly secured with minimal credential policies.