Or if you really really want to, make sure it’s just a read/view only architecture?

Yes

The heat/cold switch should be a physical switch.

Honestly, where's the excitement of having to cross velociraptor infested territory to reset the breakers if you can just remote in.

A hack will always get more power than what its designers restrict it to.

Yes, especially after this has now been happening again and again. First case can be excused as usual bad practices and lazyness. But it should have been a wake up call causing anyone else operating commercial freezers (or even other equipment) to review if/how they are connected to the Internet. Anyone getting hit now is maliciously incompetent.

Centralized monitoring of thousands of refrigerators makes sense but it should be read only.

Making something accessible over the Internet is probably the epitome of decentralized monitoring.

So I worked for a company who's product was sensor networks for this exact situation, and the European company who bought us had a cloud-only solution they wanted to replace our on-premise product with. Thankfully most hospitals and research institutions in the states are smart enough to reject cloud-based solutions for this exact reason. In theory you could penetrate our systems but it would have to be a very direct, specific attack to be able to do it. My colleague in Germany has been an SWE contractor since 1978 and is genuinely the best engineer I've ever worked with. No matter how off the wall my ideas were he'd already considered it and eliminated it as an option.

[delayed]

And hooking systems into the cloud over the WAN helps them how?

We're expert of the EU MDR, the "new" medical device regulation, and there are many Cloud services trying to seduce customers. But clearly no-one wants to have their software online: Medical industry is crossing the chasm when they can control when their Cloud software is upgraded, but the aerospace is a hard no and the ISO 26252 field (automotive) is even worse. With AI and Trump, it gives them reason.

The Cloud thing is completely driven by software companies, not by their customers. I'm really surprised that we did succeed at forcefully moving unwilling customers to the Cloud, it really doesn't answer their needs.

You can learn from TSMC or power grid networks. These networks are highly secure and must be separated into internal and external networks. There shouldn't even be any chance for the external network to access the internal network.

Of course, physical ports are also a risk, but they're easier to detect. At least someone has to come in.