... Who the fuck is putting this shit on a network that's not closed circuit?

Vendors install these so the store owner and them have easy access to alarms and controls.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past.

Two things worth keeping in mind:

1. Connecting them was probably considered best practice when they were installed in 2005 2. Their support contract required them to stay connected