Blues, while none of the control systems may have a direct Internet connection, what about the computers you access the control system computers with? I very much doubt it's air-gapped.
Your organisation has still purchased a system that is too tightly bound to the OS being used and they aren't prepared to keep it updated due to expense. How can that be a smart purchase?