Municipal water facilities report falling to hackers in separate breaches

Years ago I asked my brother, who's been working in software with major big-brand companies for decades, Why are water facilities and power plants connected to the internet? Because they want to save the money to have a certain number of people on-prem? He just shrugged.

Thinking you can be both online and secure from hacking is hubris. If you are a public utility—water, electricity, health—I feel more and more that it's plain irresponsible.

https://cyberscoop.com/epa-calls-off-cyber-regulations-for-w... ("EPA calls off cyber regulations for water sector")

I understand why municipalities want these facilities connected to the internet. However, I can't understand why it is allowed. We really need to take the security of our critical infrastructure seriously.