The circumstances that led up to this failure of organizational security are a combo of IT apathy and vendor lock-in.

IMO you should not be running windows on hardware whose failure could cause deaths. Maybe windows could be secured to prevent this but that would require IT staff to keep things updated which does not always happen.

A much better solution is to run locked down Linux or BSD.