Automation doesn't require connecting to Internet.
It’s hard running that type of network securely, and costly to run it alongside a normal internet connection.
Cheaper to just use the internet connection and squint a bit at ‘securely’.
Could the same thing be done with SMTP way more securely than opening up your firewall to some random AWS EC2 instance? Yeah no doubt.
Do you think grocery retail execs actually understand computers past Microsoft Word and Excel? I report to one, they can barely listen to me say the word WAN failover.
Like all things in IT, experience is the best teacher. Organizations will fail to invest in their technology, security included, and only then will the execs start to trust that the wizards in the backroom are telling them truths instead of asking for new toys - if they're lucky enough to still be the same exec that heard they should take security seriously before the Bad Thing happened.
Very likely they were sold on these internet-connected systems without being told about the drawbacks, which is sad.
It’s more costly to do it properly, so most don’t.
I'm catching issues as I can as the head of IT at an org replacing our Danfoss systems with something else, but it wasn't until about 1.5 years since the initial decision to replace them that I'm finding out from a sub-contractor of the contractor that there's a cloud app our HVAC network will need to talk to - which is not-so-funnily enough a requirement by the state for us to receive associated grant funding for a portion of the new system cost. This was never mentioned to me at all as the head of IT. It's not even a convenience vs security issue, it's a misaligned corporate communications and approval channels issue. In other words, the capacity to secure your technical systems is downstream of political organization.
Even in that case there is zero reason for the devices to be reachable from outside the network rather than the devices reaching out to known hosts only.