I can see reasons for why you would like to access them remotely. The bigger question in my mind is why are they connected to the internet so shittily?

When we place devices in customer networks we have the device open a VPN tunnel back to our concentrator node, and route our management traffic through it.

Then the customer firewall blocks anything incoming as usual, and all we need is the rules to allow outgoing VPN client traffic and established rules for the responses from the server.