Not isolating the refrigerator API from the Internet seems very negligent.

The refrigeration business does not really overlap with infosec or IT in general.