It is common practice. It is done in various ways though. Sometimes they're physically separate networks, sometimes via routers and VLANs. Only the smallest plants have a single network where you can reach the internet from the PLC network. Usually this is fixed as soon as the company is big enough to build a decent network infrastructure.
At the big manufacturing companies I've done work for: 3M, Johnson & Johnson, Anheiser Busch, Ely Lilly, Pepsico, Bayer-- all these companies have huge network infrastructure and policies that keep PLCs physically isolated. There is no way that the exploits here could be useful against them. Even smaller companies such as Bacardi or BASF have these same policies in place. You'd have to target someone really small and vulnerable. A company big enough to be using a SCADA system, but not big enough yet to incorporate a decent network infrastructure to protect itself.
I've seen those companies too, but none of their names you would recognize because they are too small. Yes they are vulnerable. Pick any small town with a population under ~30,000 and you'd probable find an automated water plant or two you could infect. Big deal.