... Who the fuck is putting this shit on a network that's not closed circuit?
Vendors install these so the store owner and them have easy access to alarms and controls.
A VPN per store would be too complex for the vendor so they just expose these to the open.
Same story as with all the hacked OT/SCADA systems in the past.
Two things worth keeping in mind:
1. Connecting them was probably considered best practice when they were installed in 2005 2. Their support contract required them to stay connected