Which is easier, getting the audit trail from non-internet-connected devices, or keeping all the devices patched?

The right answer isn't forever patching freezer software. The answer is either to not have them on the internet, or to have something in front of them, and keep that thing very up-to-date. (Or maybe several layers of "something" in front of them.)

Just keep them read-only, if a freezer need to be defrosted send an SMS to the store manager with the message “go hit the defrost button”.