This slowness also means it sometimes has a hard time understand new risks and a lot of industrial systems are not operated by people who understand those risks and do…very stupid things.
The best systems are implemented either in-house or by a team of consultants working hand-in-glove with the in-house IT or ops teams, then maintained in-house. That's been my experience. Unfortunately your average municipal wastewater plant is probably run on decades-old systems by the same IT dept. that fixes the city council's printer.