You can replace the PLC. It's not like a modern PLC couldn't be made to control a 1990s fridge. The question is "Who will pay for the upgrade". DanFoss sure as hell won't. The stores won't, because they've already paid for the fridge.

Honestly I feel like this should fall under a support contract. The pricing structure could be similar to that of Microsoft. Support is fairly cheap, X number of years included in the purchase price, once the product reaches EOL the price goes up dramatically each year.

There's a massive problem in how we think about these products collectively. They are inherently insecure, they will be attacked and preventing it is expensive. You could build a safer alternative, but you'd be priced out of the market instantly by less safe, but more convenient alternatives.

This will never fly. Some devices can be used for tens of years and they may face vulnerabilities that the hardware cannot support any kind of software fix for them. Imagine the world moves to TLS2 or whatever something new will be called and the hardware you have is too slow for it.

On the other hand, saying an industrial device should receive security updates for 10-15 years instead 5 or whatever happens this days it will be a major step forward. This will incentivise vendors to use better hardware with room to grow, not just the cheapest components possible.

Or, make componente modular so that you can upgrade just the control unit instead of the whole fridge or whatever.

Insurance does actually tend to put cybersecurity requirements on to businesses they insure, the problem is that it's pretty hard to write cybersecurity requirements that actually result in secure IT systems as opposed to just a bunch of compliance work.

As someone who has worked with small and medium sized businesses, reasonable is extremely variable. I'm dealing with a small business right now that can't upgrade their perfectly good computers because of TPM issues. On one hand, I kind of get the reasoning behind it, but how can you hold a business of 10 people accountable for not knowing how to buy a computer that will be reasonably future proof? Every business needs IT on hand? I think that's asking too much. On the otherhand, you should know the tools you need to run your business. There's no fine line.