Well, yes, if somebody has set up a WIFI AP which contains the credentials to connect to your factory LAN, and that AP is physically accessible to an attacker, then your security is
zero. Because that AP must store the credentials in plain text somewhere. Or encrypted under a key but that key must be stored...
I too remember the days of Netstumbler, WIFIfofum, etc
![Smiley :)](https://www.eevblog.com/forum/Smileys/default/smiley.gif)
They probably still work in some places. In the old days, I could drive 10 miles and log 600 unsecured WIFI APs...
But you cannot control your customers' stupidity. What you don't want to do is sell a box which can be hacked remotely. Unfortunately IMHO this is not avoidable if running "simple" embedded products. I think most IOT devices can probably be easily crashed by malformed packets, but that in itself won't get you anywhere.
Cash machines use a special tamper-proof module to store important stuff, like the key which is needed to change the PIN number on your card. This is a surprising weakness of the whole system. Someone told me many years ago the PIN number is (or was) encrypted with DES and stored on the card thus. So the cash machine needs to contain the DES key. DES is highly secure in a commercial context (yes I know the hype all over the internet about deprecation). It uses a module which (I know only how it used to be done years ago) you have the circuit board, encased in glass which contains a wire, and if you get in you break the wire, and the SRAM holding the key(s) is erased. This stuff was developed to a high degree in the 1990s onwards. I had a customer in that field. Nowadays, smartcard chips claim to be as good but probably are not. If you need key and certificate storage which is resistant even in the hands of an attacker (a cash machine is easy to steal, with a JCB) then you need to use something like this. And it
is a hassle, not only because you need to use the CPU in the smartcard for some processing. I designed a product many years ago with the Siemens 44C200.