A security advisor at work recommends migrating to SaaS so we don't have to manage any of the infrastructure. This makes me wonder.

These topics often get "why is it even connected to the internet" comments. This makes me wonder if they're buying a "complete system solution" where it's not an operator decision but a manufacturer decision, and maybe even reasonable in regards to generally being accessible and manageable, with critical systems separated within the whole-bundle system. But often, the necessary safeguards and system separation are not in place anyway. Offloading responsibility doesn't mean it gets done well, unfortunately.