"This. Combined with the fact that the handful of people who have the knowledge/experience to properly secure the systems are probably too busy/overworked to expend the time to improve the situation"

That's not true. There's tons of people that could setup VPN's or whatever for them that are better than what we see. The actual problem is management doesn't care about security with no financial damages for that in most cases. So, they don't try to secure the project. I've known a few engineers doing embedded systems telling me how their customers almost always ignored warnings if dollars invested was somewhere above zero.