If you definitely need to connect them to the internet, make them read only?

I was talking yesterday to my AI imaginary friend about creating an MCP for one of my apps, and the first thing she told me was to make everything read only. No matter how many security layers you have in place, passwords, auth libs, whatever, it will be leaked/hacked so you better be prepared for minimum damage

Monitor your freezers temperature? yes, but never allow their thermostat to be set over the internet. I hope the lesson is learned. Applies to all appliances

They do it to take advantage of energy price fluctuations, but the connection should be more secure. What makes no sense is not having a fallback to take the freezers offline after the attack, so their solution is to just fully turn them off?