1) "They" have no idea what exposed to open internet vs LAN vs VPN even mean. They have no idea what these terms mean, they just want the easy access. Same reason why open RDP to 3389 used to be so common. Vendors install these so the store owner and them have easy access to alarms and controls. So they vendor installs it for easy access, shows the store owner, store owner trusts vendor, but vendor has done the bare minimum. Because the vendor wants it easy too.

A VPN per store would be too complex for the vendor so they just expose these to the open.

Same story as with all the hacked OT/SCADA systems in the past. Like those hacks where some SCADA system is open as a website with pump controls.

Imagine they where internet exposed due to simplicity. Imagine you are a store owner with 0 IT knowledge.

The issue is this needs to be handled centrally by the parent org also. They have IT ofc but they usually do POS and desktops/servers. The OT/SCADA systems are usually totally separate and not touched by the white collar IT systems.

2) Yes, obvious it is Russia doing this. Very handy to be able to disrupt food supply and they are also checking our response and time to restore.