Hi,
Profinet-IO is layer 2, not routeable and real-time so a 4G connection is certainly not a good match for that. But the scada comms to the S7 plc's is, depending on the type (1X00 will work), mostly some s7 protocol over tcp/ip and that is no problem for the rut's! Siemens also calls that 'profinet', but it's (luckily) plain tcp/ip underneath.
Yes you can connect Scada's simultaneously to the plc's depending only at avaialble conenction resources in the plc's (and scada).
No, don't need a rut at the Scada side but read on.
I wouldn't connect any plc to a internet public address! I would use at least some sort of access control or a vpn to access the plc. As long as the scada side has a public address the plc don't need a public address and could setup a vpn (wireguard, openvpn or other) to the scada's. There you could use the scada or a rut as vpn server.
Or you could indeed, with some plc programming, use modbus tcp.
hih,
I didn't see any attachment..