Connecting to a hotspot does not necessarily mean anything at all about security vulnerabilities of either system. A property maintained system should have no issue, either for the network system itself being connected to or especially the systems connected to the internet through it.

This is a different thing entirely if what is being connected to is a local intranet network although from what I'm reading, that's not what is being described here. Such a connection would leave you open to much more vulnerabilities but a simple internet connection doesn't give you backend access to a device unless it's specifically set up that way.

Regardless, these machines shouldn't be connected to the internet at all, that way vulnerabilities become almost non-existent outside of some crazy CIA trojan that would phish for a specific device. They did this to disrupt nuclear reactors in Iran by destroying some Siemens devices hooked up to them, eventually an Iranian scientist hooked up to the local network with an infected laptop and it was unleashed on the broader system that wasn't connected to the internet.