What if I told you some legacy control devices on protocols like modbus don’t even have the concept of users/auth. Just send a request with a valid op, in range register, and a valid crc and the device will just read or write whatever you send it. There are literally tens of thousands of these devices still online and internet accessible globally.