I have absolutely no understanding of ATC systems, though I would’ve thought that having a well established and (I would assume at this point) robust process of using a somewhat ancient media would reduce the attack vector of anything malicious finding its way into ATC systems.

I would love to know how often floppies are used day to day in ATC to warrant this?