If you're using WinCE to control a freaking CONTROL SYSTEM...
...then you really do deserve everything you get.
These systems should be controlled by robust PLCs. Not fragile PCs. That's not to say PLCs are perfect. We know that security is an issue with a lot of PLC manufacturers, but you can mitigate that with firewalls and VPNs, but they are thousands of times more reliable in terms of just keeping running than a leaky Windows operating system.
Add to the fact that the vendor was informed TWO YEARS ago by the black-hatters (sounds like a very white-hatty thing to do, IMO) and they clearly don't give a rats ass.
Then they have the balls to issue a statement saying that all washer systems should be firewalled! If I had one of those systems on my forecourt, my response would be "So when are YOU coming by to put a firewall in, then? Until then, the system is switched off at the main breaker, since world + dog will now be searching the internet for your fucking web-based carwash user interface."
You really can't make this shit up, can you?