From the stories I've heard I wouldn't be surprised if some were still on DOS. It's hard to develop in house with a tightly controlled budget and it's hard to outsource when you're dealing with sensitive data.
DOS? I still have to maintain basic CP/M proficiency as one of the pieces of heavy machinery in our workshop is controlled via an über-proprietary interface firmly embedded in an M68k machine.
We only got rid of the VMS controlled CNC lathe a couple of years ago - it ran off a VAXstation something-or-the-other. A 2100, methinks.
Granted, these machines didn't pose much of a problem besides scarcity of spare parts - neither of them had any need for a network, anyway.
I've seen a lot of specialized measurement equipment running on ancient hardware - oldest I've personally seen is a microwave radar analyser running windows 3.1 as far as I know this is due to a specialized hardware card.
Some industries are still full of Unix boxes from the 90's RS/6000 vintage. I've heard oil and gas industry is pretty bad for this sort of stuff especially in industrial control systems.
I wouldn't call it bad as such, if it is fit for purpose, it is fit for purpose.
Problems arise when some bright spark figures out that it would be much easier to collect data via a network, directly from $Expensive_Device - or when another bright spark in accounting figures one can do without spare parts; after all, OEMs are supposed to keep stock of spares, right? No. Not years - decades - after sending out the EoL notice.
As an aside, I probably have one of the largest concentrations of Motorola pSOS hardware in the world in my shed (that is, the office next door) - my employer used a LOT of pSOS kit in the nineties, and as the platform became obsolete, noone thought to preserve a supply of spare parts; I quite literally dumpster-dived to reclaim whatever I could which warehouse staff had been told to get rid of.
Still happens every now and then that a customer asks for pSOS thingies. I really should get myself a stuffed dodo to put on the shelf next to the Motorola boxes...
We only got rid of the VMS controlled CNC lathe a couple of years ago - it ran off a VAXstation something-or-the-other. A 2100, methinks.
Granted, these machines didn't pose much of a problem besides scarcity of spare parts - neither of them had any need for a network, anyway.