Have you seen this article?
https://www.businessinsider.sg/western-countries-send-servers-full-of-sensitive-information-to-foreign-countries-2018-12/

According to Business Insider, Western companies routinely sell hardware they no longer need to private companies in foreign countries. Most of the time, they do so without wiping the sensitive data on them first. This also happens in the rail industry, for example, codes, software, and procedures for the traffic lights and railway signalling for a few major Spanish cities were exposed to foreign private companies. As you can see, this is a perfect example why "security by obscurity" doesn't work. Furthermore, if such information is eventually abused to launch cyber attacks, companies should have a solution that provides continuous security monitoring of their signalling network.