The PLC that lies: sensor-actuator decoupling, structural blindness and the metrology of risk in OT cybersecurity (2010-2026)

OT security management relies on vulnerability advisories, CVSS scores and exploitation catalogs, on the assumption that these instruments describe the threat. This study tests that assumption through a scoping review of 73 studies, an audit of 3,966 CISA ICS/OT advisories (2010-2026; 12,441 CVEs; 14,878 CVE-vendor links) and a controlled simulation of a CSTR reactor. The review shows that the physical I/O surface, where a PLC can misreport the process state without violating the protocol or the logic, receives 5.5% of the field's attention, compared with 21.9% for the network and 16.4% for control logic. In the registry, data integrity accounts for 0.84% of CWE entries; only 2 of 3,776 ICSA advisories contain expressions compatible with process integrity, and none describes it. The 14 I/O techniques in ATT&CK for ICS represent 11.0% of the total, have lower detection coverage (64.3% versus 84.1%), and two are listed as "mitigation limited or not effective". The census is concentrated (Siemens: 26.2% of advisories and 47.3% of links; top five vendors: 57.7%; Gini 0.863); severity ranks exploitation but does not calibrate it (AUC 0.726; 97.4% of critical CVEs are not in KEV); 88.2% of exploited CVEs are IT stacks, and 66.7% of them were already in KEV before the OT advisory. In the simulation, a coordinated sensor and actuator attack produced a physical divergence of 14.8 K with no alarms and no trips. We conclude that structural blindness is a property of the observation architecture rather than of any particular detector: both the registry and the defense measure what the PLC reports, not the physical state of the process.