It's more just what happens when you don't have sensible monitoring and/or incident response.

> There is no reason for them to ever have an internet connection.

You can't know this.