At least in my experience, there aren't many opportunities for career growth in that area unless you switch to regular app/web development, or you move to a snazzier company like Microsoft, Apple, Amazon, etc. (Or start a disruptive startup..)
I wonder if there's a "brain drain" effect that's causing this industrial software to be persistently low quality and susceptible to attack
And yes its a mess. Folks resist using real security on their phone or desktop. Imaging an embedded device they buy and want to forget about. They sure don't want any passwords or keys that they'll promptly forget! How many times have I reset my router to factory defaults because, who knows what the admin password is I set two years ago and never used since?
I've put security into devices, and had the client want it taken out. Because their installers find it onerous. And, 'nobody is going to attack my pool pump controller!'
You don't really have to sweat the security of the key laying around because its mere existence requires an attacker perform physical penetration which is a different attack profile from someone just cruising Shodan.
Granted, a USB key doesn't make sense for every device, but e.g. it seems like it would make a lot of sense for my router.
Then charge like crazy the same way dealers do with car keys.