Application and VPN work on totally different OSI layers, so what other comment already pointed out - it's defence in dept that exactly is meant to prevent such cases: when one control fails, other might save the day. IP whitelisting is mostly suitable for centralised command center and fixed locations which might have been sufficient in this case, as I really don't believe that these fridges were individually and manuallly controlled by human users via their phones rather than some server and automation.