You cannot rank PLC protocols against each other: they run on different controllers, and the controller changes every number. What you can compare is a job. Ten protocols, seven vendors, the same values at the same rates: bytes on the wire, time per read and what each job costs the controller. How the client asked decided the cost more often than the protocol did.
Every Beckhoff controller already speaks ADS. OPC UA is a licensed server on top. Measured from the controller’s own figures: reading natively by address barely registered, up to 2500 values every 10 ms. A busy OPC UA server put its work in the PLC task. Resolving names in the runtime on every read cost up to 40% of its CPU. A look at what the OPC UA license buys, and where each way of reading puts its work.
How you ask a Siemens PLC for data matters more than which protocol you use. Reading the same hundred values off the same controller, a client that groups its requests is a hundred times faster on Modbus and five to fifteen times faster on S7Comm. That is larger than any difference between the protocols themselves. A measured look at what protocol and driver choice costs a PLC, a network and your budget.
Five federal agencies told operators to get their S7 controllers off the Internet and behind a boundary. That instruction is right, and it carries more weight than its place in a seven-item list suggests — because several of the device-side mitigations beside it do less than their labels promise.
A modern S7-1500 or S7-1200 answers on three quite different doors, and they do not enforce access control the same way — or, in some cases, at all. A map of the native S7 channel, the OPC UA server and the web server beside it, and the fieldbus underneath.
Three checkboxes on every S7 data-block variable read like runtime access control. Two bind only the OPC UA and Web API doors, the third never leaves the engineering tool, and the protocol most HMI and SCADA traffic travels over honours none of them.