Which is easier, getting the audit trail from non-internet-connected devices, or keeping all the devices patched?

The right answer isn't forever patching freezer software. The answer is either to not have them on the internet, or to have something in front of them, and keep that thing very up-to-date. (Or maybe several layers of "something" in front of them.)