I find the case of having enough money to put all of that on internet and centralize management and not having enough of it to set up a rudimentary VPN unlikely. The money is not the reason.

Those systems are not cheap. It's not the case of lacking few hundred bucks to put it between a VPN box.

It is simply just "well, we weren't hacked before, why change?". Back when those were installed that was just not in the field of view and most those people worried about is changing default password.

And there is another case for industrial equipment, even if it is out of support, what you gonna do, trash a machine because of it ? No, it will be running till it falls apart or it will be more cost effective to replace.

> But I'd setup Tailscale and-- would you, the grocery store manager running on 3% margin, really? What if you're part of a chain and it's centrally controlled elsewhere, like all the other decade-old tech you use but have to call and wait for a dispatched tech to handle?

You either pay small cost now, or bigger cost when someone finds out. So, yes, really. We live in times where you no longer have to pay $500+ for enterprise grade VPN box, you can do very acceptable security wise solutions on cheap hardware or on literally "any old piece of junk"