@jerry
True - but most ethernet HMI interfaces and PLCs can be now be remotely edited, (rockwell studio se for instance), which leads to the boxes running them being on the corporate net, so the lazy automation engineer can do it from his desk. So you may not be able to crash the actual IO networks, but you can certainly get to processors and HMIs.