That, and why there's not a company VPN in between.

These industrial networks are often not internal to a single company, sometimes by necessity. They also are often installed in places with inherent connectivity difficulties, so sometimes you are bridging weird networks that limit what is possible just to get the signal out.

These aren't consumer fridges with wifi. The situation on the ground is significantly more complex. There are a lot of embedded sensors and control systems in supply chains in order to minimize waste.

Because a main user of this is the third-party HVAC contractor, and there's a operational cost to getting him set up on the grocer's VPN. (He has thousands of clients, that's in aggregate a lot of customers that would need to give him VPN access. He will do whatever the client asks of him, but he will bill accordingly.)