I can't see whats wrong...
"a feat that should not be possible according to best practice that requires separation between industrial control systems and the public internet."
Well it was separated; a windows XP SP1 machine sat in between the furnace and the public internet, what's wrong with that?