This post is interesting.
Pretty good overview for a tech article in a normal Non-tech venue.
ATM's share quite a bit in common with ACS though I would hope they are in better shape from a security perspective.
They are often older tech. They are more difficult to update than other systems might be. Actual physical security is a mixture of both better and worse than typical IT systems. They are certainly closely watched but are often in an area where the actual owner has little control over the environment.
I am not an expert in these systems but would be interested in hearing from one.