That seems pretty location dependant. In Australia at least the two major supermarket chains are not insignificant (e.g. EBITDA ~$5 billion and ~$2.6 billion) and have large internal tech and cyber teams.

I think this is more indicative of the plethora of technical debt and straight up technical negligence that's accompanied the past 10-15 years of internet connected everything. What's happening today is the predictable result of project based works funded by capex deploying assets (of all types) with no consideration of opex funding for the technology components.

Just because a webserver is running in some physical device (fridge, camera, vacuum, washing machine, pump controller, lighting system, audiovisual equipment, access control system etc) does not magically exempt it from the same sort of ongoing sysadmin and maintenance you'd expect as a baseline for something running on standard compute. That applies equally to manufacturers publishing firmware, and the asset owners/service companies that have the responsibility to apply.