Todays PLC's also allow navigation through the controller backplane to anything else that's connected. If an isolated network, like Devicenet was used to communicate with IO for example, those "air gaps" may not exist at all. Since Devicenet is a Master-slave communication arrangement, similar to other CAN based protocols, an attacker may be able to imitate the primary master and send false commands to the slave devices. In other words, those more obscure industrial networks can be compromised. Sometimes easily. Security by obscurity is also not an option...