From FCW:

Bryson Bort, a cybersecurity fellow at the R Street Institute, told FCW the problem of government systems using outdated operating systems, like the Oldsmar facility did, is probably “widespread.”

Industrial control systems are “built for a long operational lifecycle and the devices and software were developed on the [operating system] that was available at the time. As an OS goes end of life/unsupported, there is oftentimes no way to even provide an upgrade or a patch,” Bort said.