Leased lines, MPLS, custom routing setups, hell just a VPN that fails closed. There are so many options for doing this, all more secure that just slapping a device online behind whatever router the cheapest ISP gave you.

The problem is that many of these setups are put behind essentially consumer connections, but with a better support contract or simply fitted with a 5G modem and a SIM card from the cell provider with the cheapest plan.

Building a WAN isn't magic, but it does require working with (competent) ISPs and paying the higher cost.

Remote control does not mean "has a public IP address."

Yes you might need to be able to centrally monitor and manage things but that should be happening on a private network.

Surely, there must be a way that does not force the devices onto world wide web..

I'm interested to know how many "legacy" controllers no longer patched by the manufacturer are operating solar and wind farms today.

If it's a lot, maybe the manufacturers should be compelled to provide security patches if remote control is required to operate their products. For the sake of national security, of course.