> Retailers are enterprises with 100s of vendors that run on a shoestring. On top, they use a lot of legacy architecture and hardware.

That's a really strong argument for why systems like this need layered security and should not accept incoming connections from the internet at large.