Danfoss said some systems targeted in the Netherlands remained connected to unsecured networks and were still using default passwords.

Speculating, but I would imagine the attackers were able to either override the settings using default or easily guessed passwords, or perhaps even replacing the firmware or programming to spoil the food. Industrial controllers are not the most secure devices. That world is due for a reality check.