There are Windows computers in there. They are not connected to any outside network "to be safe". Therefore they are protected, even protected from updates. Software that runs on them is validated for that specific OS version with a specific state of updates applied.

Regulations say you can't just ran any random device (including software) there, that's unsafe.

Unfortunately regulations weren't being made with PCs in mind where anybody can plug in an infected USB stick. Or needs to in case he's a service technician. (Yes, those ports are not available for "anybody" who is there, but somebody needs to install software on those machines).

There are things I have seen I wish I could unsee to feel safe.