I agree that using a VPN is much more secure. And together with not allowing remote temperature control, this would have prevented this specific issue. Still, if you have a VPN in a large supermarket chain, you need to manage the access keys - in a way that when one user of the VPN quits the organization, their access is revoked. And also, it isnot a good idea that many people share passwords to devices which give administrative rights. So, you should give a unique password to every user, similar as every guest in a hotel gets an NFC card with a unique code. The best way I know of to do that would be a PKI and smart cards. This also prevents users from using dumb passwords or using the same ones in multiple places. But my impression is that very few organizations like supermarkets do that. It gets even more complex with the modern rush to outsource every little thing.