The industry loves a neat PLC story because it keeps the threat in a box you can point at.

The less fun version is when the same campaign walks through identity or an admin plane your org still treats like plumbing.