"...approximately 5,800 ATGs with TCP port 10001 exposed to the internet and no password set."

Are we talking about simple monitoring information here, or some kind of administrative access?

"In our opinion, remote access to the control port of an ATG could provide an attacker with the ability to reconfigure alarm thresholds, reset the system, and otherwise disrupt the operation of the fuel tank."

Remote access to a control port would indeed conceivably allow these activities, no "in our opinion" required. But you haven't told me whether this is indeed remote access to a control port.

Also, the ISP pie graph just looks like a typical distribution of customers across ISPs. How useful is this supposed to be?