just because there is an html page being served doesn't mean you can access the control systems.

you're also assuming no one has done it - I have no idea wether or not someone has used shodan for malicious purposes, but that certainly doesn't mean it hasn't happened.