First, they are refrigerators. They do not need to be connected to the internet and should not be, period. You want to remotely manage them? Use anything but the internet.
Second, why would you make them remotely accessible FROM ANY IP ADDRESS? Do you not know what a firewall is? A whitelist? Conditional access?
Third, why the fuck would a REFRIGERATOR need the ability to COOK anything? Did someone forget the difference between Fahrenheit and Celsius and give them a max temp of 50C when it should've been 50F?
Fourth, vendors should be held liable for this shit. Manufacturers who provide always in fully connected devices should not get a "get out of liability free" card by saying "you should always upgrade to the latest firmware" and should be held accountable for producing REFRIGERATION units that can be turned into OVENS.
Fifth, and finally, as per the norm, I did not RTFA so maybe it mentioned this, but I'm willing to bet there were default passwords still in use. Yet another thing manufacturers should be held liable for. It shouldn't be possible to hook it up and start using it without configuration that requires setting reasonably secure credentials.