Those devices run in a private network and usually don't have any internet connectivity at all. If they do access the internet, it's usually limited to a few hosts that can easily be routed over some compatibility layer or a proxy.
And that's not even counting the various integrators that just don't implement any kind of security at all.
I fight against this sort of thing all the time. Sometimes I get my way.