Was the need for security in the industrial internet of things (IIoT) underestimated?

Yes. All processes along the value chain and networking components need to be protected 

As someone who has a few US patents for inventing various devices and software, right at the very beginning of the IoT revolution, I can tell you that lack of security was exactly why I designed a new proprietary secure protocol for Wi-Fi!  At the time, all we had was the initial WEP standard and that was tragically insecure. 

We also wrote some network management software to manage our proprietary wireless access points, that allowed us to create the first wireless VLANS, and we also included as much security as we could at that point in time; we wrote custom MIBs (Management Information Base) for SNMP stats and control, because there were none available at the time.

Early on in the IIoT space, none of the technologies underlying those devices had changed in 30 years. But the business opportunity turned out to be far more challenging than anybody foresaw at the outset. Back then I would deal with SCADA operators who would tell me, "I've been sitting here for 30 years clicking this button. I know that when I click this button, this happens over there, and that's all I care about. We don't get attacked. I don't care about security. Leave me alone." So how do you sell security to somebody with that mindset? It was challenging, but everything's changing. I see our federal government's involvement in critical infrastructure protection and cybersecurity reporting, which is wonderful. That forces people to do something as opposed to hiding behind the belief that if something isn’t broken, you shouldn’t touch it.