If you have spent Loadamoney on a bit of kit then it is your duty to make it as secure as possible.
You can't air-gap it but you can isolate it on its own physical subnet behind a carrier grade firewall. etc etc
Don't for christ sakes put expensive bits of kit on the main ethernet backbone.
If you do then you need to be put in the MRI scanner and left there to fry.
Only a few years ago, my local NHS trus had a lot of their data on a VMS system. Some high paid MS consultants came through and the VMS System was gone.
MS has a lot to answer for.
When with a country say to MS, get outa here. You and your insecure POS are not wanted here.
Will this event be the catalyst that makes this happen?