Have we learned nothing from 80's movies? WarGames, Superman III, Jumpin' Jack Flash, The Manhattan Project, Ferris Bueller's Day Off, Prime Risk, Hide and Seek, Revenge of the Nerds, and more showed us what happens when a business or government leaves computer connected and always on.
I would recommend we not plug everything into the Internet. Or at least use two layers of authentication, one for the VPN, and one for the devices themselves on the private network. With no NAT while in the private network.
But for industries that buy off-the-shelf monitoring systems, that's not how they actually work. They are really just the equivalent of an wireless router running embedded Linux, glorifies OpenWRT to hook a site's LoRa/Zigbee/802.15.4 sensor network to a gateway to store and forward monitoring data. Ideally not doing controls, but honestly if you unplug the safety monitoring then you have to shut the whole system down. So even a sensor systems is a viable target if the goal is a simple DoS attack.