The obvious worry about an internet-connected sensor is that it becomes a way into a network, or that someone replaces what it runs.
- Units make outbound connections only. Nothing needs to reach them, so no inbound rule or port forward is required on a store's network.
- Each unit has its own credential, so one compromised device cannot speak for another. A credential can be rotated or revoked at any time.
- Firmware images are cryptographically signed and a unit refuses one whose signature does not verify — a compromised network cannot install its own software on your hardware.
- Units verify the server's TLS certificate rather than accepting any responder.
- Devices send measurements. They hold no personal data and store no customer records.
Cellular units don't touch the store network at all, which for many IT departments is the simplest possible answer to the question.