Not sure if this really is the truth of the story, but if it is, then it is not build in one day and a lot of its components are build into the design of all of the modules.
For example, the Siemens' controller attack most likely is the work of Siemen as a self destruct safety switch in case these components went into the wrong hand. I wouldn't be surprised that only the end users in friendly states get the good code and the off the shelf parts come with the bugs. This also goes with the parts in the network equipments, computers, security systems, etc.
Makes you wonder what would happen if someone else have this same capability to do this to us.