Vendors install these so the store owner and them have easy access to alarms and controls.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past.