Comment by sgc

Well it would receive control signals from an on-site relay server with the hardware to communicate with it, and that would of course also be firewalled and use encryption to communicate with the outside world. That server could always in theory become compromised despite your best efforts, so the benefit is obvious: don't create even the theoretic possibility of being hacked by a class of message that should never exist.

The idea is not to solve everything with one simple trick, but to reduce the attack surface as much as possible in hardware. If you are dumb enough to make your 4 messages something like off, on, hard reset, random dangerous maintenance protocol, then it does nothing. If instead it encodes 4 useful and typically used states that can't destroy your system, then you have massively reduced the requirement for onsite, and accepted that more serious issues require onsite control.