I agree with you for a large part. I am talking about OT and IT. Operation Technology, IT in factories. Just that industry has IIoT and hopefully not IoT. IoT secure in an manufacturing environment.
There are differences in IT and OT.
IT can be state of the art equipment with high frequency scheduled maintanance and acceptable downtimes. While OT can have no downtimes, low frequency maintenance and running on old equipment that can't be changed or is too expensive to replace quicly. I know a plant that runs in total island mode where the reports will be printed out and scanned in office for office work. And vice versa. Just until the whole plant is finally migrated and upgraded.
OT is still slacking severely with security with a history of bad choices where one should be ashamed of and a culture that as long something runs, it is okay. And therefore IEC62433 security standard is created and manufactures are creating more awareness. Stuxnet opened the eyes a bit. A PLC that is 20 years old looks cool, but is not feasible anymore.
The usage here of Modbus/TCP is a great example of an old, unreliable very non-secure protocol that people keep on using. Because "it is only local, and very cheap" 
While OPC UA, Profinet, Ethercat are better solutions.
