In my opinion the definition of PC based by Beckhoff can be misleading. I think when the majority of people hear the term PC-Based control, they immediately think of a PC running Windows NT/2000/XP/7/8/10. Beckhoff will also agree with this. However, in Beckhoff terms this also extends to an embedded control running Windows CE even without an option to connect any kind of monitor mouse or keyboard. For example the CX8090.
Windows CE is a completely different operating system from the typical desktop OS that we are all familiar with. CE is designed for embedded systems and can run as a real-time OS. You cannot load your typical PC applications onto CE nor can you play solitaire. Which means you cannot even load your favorite anti-virus software. To my knowledge CE is not a threat for any viruses.
So the question is then, can a Windows CE based PLC be considered a PC based controller? If you answer yes, then consider an Allen Bradley ControlLogix that runs the VxWorks operating system. That OS is capable of supporting a monitor, keyboard, and mouse. Does it then make the ControlLogix a PC based PLC? But wait a minute, the ControlLogix is not based on an Intel chip. Ok, so nor is the CX8090. So in my opinion, controllers such as the CX8090 are no different than a ControlLogix, even though Beckhoff will say it is PC Based control.
So now that I went off on a tangent, I will answer your question..... My first Beckhoff system was a large system that ran on server hardware with RAID 1 drives, ECC memory, etc. That system ran for almost 15 years before it was decommissioned. After that I did one more PC based system that operated for about 5 years.
Those were my only 2 systems that were based on traditional PC hardware. After those systems, I began to think, what really is the benefit? It wasn't cost saving. The cost of a TwinCAT software license to run on a PC was more than buying a CX controller with a license already on it. After I put all of the pros and cons together, I decided PC based controls running on traditional PC hardware had no advantages. From there on all of my Beckhoff systems I built were based on a CX controller with the CE OS. When an HMI was required, a panel PC was added to the system.
IT may think a PC based system can be made more secure, but that is not so. Do you think Norton has accommodations to protect the TwinCAT service? My guess is most likely not. So whether the PLC runs on a PC or on dedicated hardware, it is up to IT to protect the threats from getting in the door, not trying to keep it from getting to the hardware of the PLC.