I went through a manual you mentioned in another comment. It listed "High level of security against undesired user access" as one of the features but it wasn't expanded upon. So I did more searching and found cybersecurity best practices from Danfoss.

https://www.danfoss.com/en/service-and-support/fix-and-troub...

They highlight connection through a firewall, mention secure remote access methods, monitoring for data breaches, strong access controls, etc. Reasonable, but these are just recommendations, so the stores could have followed all of them or none at all.

An article about Danfoss vulnerabilities mentioned in a different comment (https://claroty.com/team82/research/freeze-the-controller-de...) says

> we searched publicly available internet-wide scanning platforms, including Shodan and Censys, for signatures associated with its management interface. It didn't take long to find what we were looking for. Numerous controllers [2765] were directly accessible from the public Internet.

So none at all is a possibility.