Are SCADA Providers subject to Security Audits?

Hello. I am a cybersecurity professional and fully admit that I know very little about SCADA technology. However, I recently became aware of a security vulnerability with a major SCADA provider that they are fully aware of and can be very easily fixed. However, when I brought it to their attention, I was told over the phone "We can do it, but we'd get too many calls to our support line. We'd be answering calls for months about this." After calling the COO in for an in-person meeting, he told the room, "If we implemented that safeguard, we'd lose customers, so we're not doing it."

I don't want to give any more specifics, because this impacts all of their customers.

With cyber-attacks against SCADA systems being in the news over and over again, I don't like this situation. Are SCADA providers subject to state audits or are there certain standards that they are supposed to meet?