I recall reading about some pen-tester or white hat security tester who, when confronted with a physically isolated system, asked "How do you update it?" However updates were applied was the potential attack vector.
The power plant at Natantz in Iran was physically separate. Zero Day is a great documentary on that attack.
Stuxnet also was a high-end targeted hack that had direct help from the power plant vendors. Big differences with other SCADA software.