The security advisory linked in that article was published in August 2025. Apparently it took about a year to finish the writeup. Unless the supermarket also spent about a year without upgrading the firmware, it might be a newer vulnerability.

Thanks for pointing this out, I hadn't noticed that. I'd expect a large customer to be persuaded by Danfoss to upgrade within a year, especially before publishing the details of the vulnerability, so you're probably right.