1. There's nothing simple about a commercial HVAC install, especially across a national chain.

2. Because they think (rightly or wrongly) that the benefits of monitoring and ease of maintenance and their contractor having direct access to the data outweigh the risks.

3. They think it outweighs the risk because IOT has been socially normalized, creating the wide perception that no, it's not that bad.

They almost certainly have insurance for this kind of event, and their insurer will almost certainly think real hard about the pros/cons of this, and will adjust rates accordingly. The grocer is free to take those rates into account when deciding on whether their next store will have an IOT HVAC.