like most products connected to the internet, VPNs and firewalls can have vulnerabilities too. As long as its not super low hanging fruit that should have been caught or is a bad default configuration, its the response that matters the most to me.
Except being exposed without protection to the hostile internet is their very reason to exist. I expect such devices to be developed with the awareness that they are going to be attacked by capable adversaries. Thus secure coding practices are to be followed and state of the art exploit mitigation techniques employed on the OS level. There's no excuse for high severity vulnerabilities to be found in these kinds of products.
You just need to threat model around that and limit exposure in case something like this happens. Most orgs dont get hit with 0 days. Therefore the best thing you can do is patch often, when possible.
Positive feedback for is completely missing from the field. Instead security professionals mock developers and celebrate their human errors. This blog post is a good example of that. Everyone has vulnerabilities and security oopsies in their processes. Instead of cataloging individual vulnerabilities it would make sense to catalog the types of responses and claimed process improvements vendors and projects have.