Industry best practice is to air gap the scada system from the outside world. But this takes effort and means you need someone onsite to make changes. Most operators decide they would rather be able to make changes remotely. But if you can log into the system from your phone, that means anyone else can also log in from outside.
That’s because they forgot to take the hitch off. You can help them by kindly removing it taking it to the scrap metal place