Sure, it could happen. There were hospitals that got knocked out for weeks with as simple ransomware attack.

If you have a dedicated hacker with means to acquire exploits, security is probably almost impossible. This is why effective mitigation is very likely the safer approach. Manual overrides or air gapped systems would help too.

But it is wrong to panic about it. The best mitigation is boring, but yes, some investment in IT could really help.