But that's exactly how these things happen. People program insecure stuff thinking 'well, at least this isn't connected to the internet', then one day someone else takes the blackbox the original guy (long departed) put together, hacks up a TCP/IP interface or does something else without looking through the codebase and boom you're wide open.
You can replay this story 10's of times over the next couple of years and lets hope it's only the nice guys finding them.
Don't get me started on that one, yes, it's probably even worse than automotive because these are 100's of thousands of legacy systems quite often without any security at all connected to the net. Obscurity is the only thing that keeps these systems working.
You can replay this story 10's of times over the next couple of years and lets hope it's only the nice guys finding them.