Oh Good Grief
How many times has this got to happen before it gets taken seriously?
Either don't connect it to the Internet, or do it properly. Laziness of this sort is a stain on the entire industry. What is it about a major piece of generating equipment that suggested to the idiot who's fault this is that security didn't matter? It's a major piece of equipment that has to be properly controlled otherwise someone somewhere could get hurt. This is dereliction of duty, leaving it as wide open as that.
The muppet developer who wrote this should be found and made to program in gwbasic for 10 years as punishment for giving the rest of us a bad reputation, with another 10 added on top for not caring about the consequences of their laziness. Just because they managed to fool their boss into thinking that they'd done a good job doesn't mean that they won't get found out later.
Safety interlocks
It would be fascinating to know what safety interlocks there are on these turbines to allow a maintenance engineering team to work on them and be sure that it won't start up whilst some poor engineer is, says working on a blade. That blade moves, that engineer could easily be killed.
If the only thing stopping it moving is a setting in that Web interface, then that's a truly safety critical piece of software.
If this is indeed the case, having a flaw as feeble as that is really, really appalling. And in this day and age developers could go to jail if there was a death.