Did they activate them to any noticeable effect?

To my knowledge, not yet. The attack surface in question is extensive, and in my opinion, targets are likely unprepared for a determined and sophisticated attacker.

https://www.politico.com/news/2026/04/07/iranian-hackers-ene...

It's 2026, and these PLCs etc. are directly connected to the internet? I think that's the most surprising aspect here.

It doesn’t surprise me at all. Show me the incentives, and I’ll show you the outcome. Security is simply not valued, in many cases.