In this case the attack was carried out against a private facility. Its workers are probably well educated in the area of making steel; but they are not very likely to be security experts. How much time and money would it take to do a complete security audit in a plant with a continuous production cycle? And then some changes would have to be made which, most certainly, will interfere with the process that workers are used to. In retrospect, that was necessary - but nobody can predict such an attack in advance. That's what insurance is for - to take care of extremely rare events that aren't worth protecting against, on average.
I'm talking about our power grid and about our military installations. We are not as prepared as we should be. I know a little bit about this.