Comment by jdiez17

I would say the takeaway is that it cannot be expected that the majority of businesses hire an IT security expert (let alone multiple, + technicians) whose job it is to keep on top of CVEs and apply updates to a variety of embedded devices. IMO it must be a legal requirement, which is now coming (e.g. NIS2), but it will take time.