I'm not talking about putting the fridges behind a firewall or a VPN.

In most factories I've worked in (if there's any outside connection at all), you would connect devices to a PLC with 2 network cards. The PLC's other network card goes to a server (that's again, ideally not on an exposed network at all).

In this case, if your server was compromised, and someone tried to compromise the PLC, they'd need to safety sign it (and often physically touch it to set it to run). You just can't hack a motor or something in a factory from afar if it's networked correctly.

It's a LOT more than just a firewall in proper OT setups.