And for anything infosec, unfortunately people who know a lot about infosec have a habit of 'crying wolf' and talking about infosec as some kind of absolute rule that everything has to bow down to with no willingness to balance against other business risks, so probably leadership is used to ignoring the people who knew that this was a big deal and were calling for action.
Snark aside, supermarkets are not in the tech business. The extent of their involvement is ringing their IT vendor to complain about it.
Commercial cold chains are expensive, high value collections of equipment that even small errors at the edges can cause huge monetary losses. And grocery stores are in an extremely low margin business.
None of this requires the customer to be technical, the ORM could ship the equipment with the network setup, and installation would just be connecting the DMZ device to the Internet.
Of course there are ways to setup these things securely, same with smart tvs and doorbell cameras and whatever else is getting hacked. People just have a bad time figuring out the cost benefit of all of this. And frankly we don’t know if that cost benefit has even been crossed yet, perhaps this doesn’t rate.
You yourself are engaging in cost prioritizing without adequate information. Sending a technician on site may be extremely expensive (opportunity costs and inventory risk on cold chains are wild).