Does it not make sense to have a "sub-layer" a local network of files rather than files being accessible by outside. I guess once "something" is in, like that Iran Stuxnet PLC attack, then it's inside and can execute from within.

Unless it's like a local attack whether by a worker or something like found a thumb drive outside, plugged it into my work computer.

not my field