Five federal agencies told operators to get their S7 controllers off the Internet and behind a boundary. That instruction is right, and it carries more weight than its place in a seven-item list suggests — because several of the device-side mitigations beside it do less than their labels promise.
A modern S7-1500 or S7-1200 answers on three quite different doors, and they do not enforce access control the same way — or, in some cases, at all. A map of the native S7 channel, the OPC UA server and the web server beside it, and the fieldbus underneath.
Three checkboxes on every S7 data-block variable read like runtime access control. Two bind only the OPC UA and Web API doors, the third never leaves the engineering tool, and the protocol most HMI and SCADA traffic travels over honours none of them.
TIA offers four global protection levels that read like the main access control on the controller. Measured on the wire they gate the engineering and block surface — not runtime tag data, which stays readable and writable at every level except the strictest.
Modern S7 firmware wraps the native PG/HMI protocol in TLS, which defeats passive eavesdropping outright. It is also only half of what TLS normally gives you: the channel is encrypted, but the endpoints are not authenticated. This is about the missing half.
Siemens kept choosing to enforce the finer-grained S7 protections in TIA Portal rather than in the CPU. That was a complete implementation for as long as TIA was the only thing that could speak the protocol — and reverse engineering broke the assumption underneath it.