Monitoring should be in a DNZ that can talk to the otherwise “airgapped” network and push metrics out to the SaaS platform or whatever. Send a technician if something needs to be adjusted, or (only if some kind of remote access super critical) give the customer the ability to grant temp access to technicians for remote troubleshooting (but require someone to be in the facility).

None of this requires the customer to be technical, the ORM could ship the equipment with the network setup, and installation would just be connecting the DMZ device to the Internet.

The question wasn’t why these systems are setup insecurely (which has an obvious answer about cost prioritization).

Of course there are ways to setup these things securely, same with smart tvs and doorbell cameras and whatever else is getting hacked. People just have a bad time figuring out the cost benefit of all of this. And frankly we don’t know if that cost benefit has even been crossed yet, perhaps this doesn’t rate.

You yourself are engaging in cost prioritizing without adequate information. Sending a technician on site may be extremely expensive (opportunity costs and inventory risk on cold chains are wild).