What makes you think that the engineering teams in companies like Siemens, Rockwell Automation, Mitsubishi, GE etc. are "a long way behind in terms of 'software engineering'"?

A bit of personal experience, stuff like Stuxnet as well as seeing bits of security research that confirm that notion.

Besides, not all control engineering is done by large corporations. There are tons of customizations done by smaller companies, whose competence varies.