If you are not using a VPN tunnel to access your modbus devices, then you are criminally negligent.

But I also discovered that an entire line of heat controllers is accessible via Modbus on the open internet. So if I want to shut down the heating for a few hundred appartment blocks, I could do that easily. And these are not actually old devices. There is even an app which you can download and control these.