IT. Whether they had the resources and competence to do so, is another question. (competent IT should also stop such devices from being connected directly to the internet in the first place).

Whoever it is, they can easily access the remote admin over the internet so there's really no excuse for leaving devices unpatched!

Ethernet drop for the freezer shouldn't get installed until this question has an answer.

Wait, it has its own cellular modem? Nevermind, then.