Agreed, it's not necessarily Danfoss's fault. The customer bought the appliance and is free to do whatever they want with it, that's what ownership is about and I fully support this. But in a situation like this, who bears responsibility? The customer whose appliance is exposed to the internet, likely having been installed by an authorized technician in the first place, or Danfoss, whose now-insecure maintenance interface listens on 0.0.0.0? I don't have an answer.

As others have pointed out, this interface is intended for use by service personnel.

My point is simply that situations like this can be prevented in several ways: on the customers side, if they have a capable IT department, or on the vendors side, by designing with the expectation that some customers will inevitably expose devices to the internet, regardless of what the manuals and training materials say.