This model has worked fine for many other types of risks.
I think this is more indicative of the plethora of technical debt and straight up technical negligence that's accompanied the past 10-15 years of internet connected everything. What's happening today is the predictable result of project based works funded by capex deploying assets (of all types) with no consideration of opex funding for the technology components.
Just because a webserver is running in some physical device (fridge, camera, vacuum, washing machine, pump controller, lighting system, audiovisual equipment, access control system etc) does not magically exempt it from the same sort of ongoing sysadmin and maintenance you'd expect as a baseline for something running on standard compute. That applies equally to manufacturers publishing firmware, and the asset owners/service companies that have the responsibility to apply.
But I keep coming back to: why do supermarkets need networked freezers anyway? Most supermarkets are open most days, with long hours. Can't any adjustments just be done manually by staff on the rare occasions when that is needed? I've seen some people argue that the major usecase is defrosting. But when you're defrosting, you certainly have lots of people on site engaged in emptying the fridge in question. Surely flipping the thermostat is a rounding error as far as costs go?
Regarding the defrosting: Commercial freezers can defrost while the groceries stay in, just like the "No-Frost" freezer at home.
a supermarket has no security team. If a fridge controller needs patching, a VPN and a strong password to be safe, that work has to come from the vendor or installer by default. One would hope that all these come by default or as a feature on these devices. It could even be a selling feature and not part of an expensive maintenance contract. A supermarket manager cannot be expected to do this work.