I worked on new SCADA for a water company across all theirs sites. Previously they were a mismatch of different systems and all airgapped.
They standardised everything and put them all on VPN. Suddenly you could access the secure water treatment works with 24/7 security guards and the control room was a bunker, from the unmanned rural sewage works with a portacabin for the server, the key hidden under a brick, and wifi for the PLCs.
The sewage works had always operated like that because it was deemed low risk. No one considered the VPN changed the threat model.
I accidentally saw a youtube ad today. It was a fake product with ai video and voice over. Complete scam. It was several minutes unskippable so i assume that's expensive. They must be hoping to scam a lot of people. I had no idea it had gotten so bad.