You clearly have never worked in one of these environments. These PLCs don't just run everything by themselves; in fact, connecting them to an external system is pretty much required. In almost every case, they are monitoring temperatures, pressures, levels, etc and transmitting that information to a SCADA (or similar) so that control operators can make adjustments, call for maintenance, etc. Much of the data they collect is useed for making business decisions and very likely is subject to reporting required by regulatory agencies. Sure, you could try using a local data logger, but then not only do you have to collect that logger, but what if it fails and you don't find out for a month? Permit violation. It's just like operating a chemical plant except the footprint is much larger.
The industry standard is to use a VPN, so whoever is putting these PLCs directly "on the internet" is doing something that everyone has been told not to do for decades. The second "sin" is that the PLC was not in run mode, which would prevent any modifications. I wouldn't be surprised if it was mainly small organizations who just buy some off-the-shelf setup and stick a 2G or LTE modem in it.