I think there is a lack of perception that information in those systems can be as valuable as the information in transit globally. Many systems managers don't fear what they don't see and can't prove. There are lots of ways of rationalizing delays in responding to threats. You can say there is no evidence that we have been penetrated, our operations are going swimmingly and there should be no concern. Managers can further rationalize that the technology is not quite there yet and expensive and not in the budget this year.
Total security remains an illusion.
All security today is partial. But I believe you can baseline processes, create a security architecture, prioritize protection of the crown jewels and mitigate the risk to the rest. It requires a disciplined process and an understanding of the strengths and limitations of products available today. Most are fairly limited. So to protect a system, you need a collection of devices and security software.