Even if you are keeping updated buying your new fridge every 2 years like the manufacturer wants, that still doesn't guarantee you are out of the woods from this issue. By definition, security patches are retroactive, after it has been made obvious that there has been a security incident.

Would such a thing even be covered by insurance? Or is it negligence for using a product after it might turn into an unstable bomb at any time?

On the other hand, wild that it doesn't revert to some sort of offline backup mode after warranty ends. Or that anyone bought it in the first place (that can't be standard in the industry, right?).

I'd hope what we'll actually see is people finally demanding that appliances with no need of an internet connection don't get connected to the internet!

I would expect a refrigerator to work 20+ years. What does a legacy product even mean this situation?

I mean, you could also argue that the lack of reliance on physical controls caused the incident in part. For example, a City's public works department may have remote access/control for some of their equipment, but they also have a kill switch that removes all connectivity and reverts the system to a default setting. They also have checks in place like "if the unit heater will be overamped, turn it off." This seems like it was caused by a lack of security considerations when making these devices "online". Old tech can work very well for a long time as long as it is modernized correctly.