If they aren't going to update insecure controllers then they absolutely must isolate them from the internet.