After reviewing similar topics I've decided to ask this question below in the Security Stackexchange forum about 11 days ago. https://security.stackexchange.com/questions/235423/is-arduino-mega-hackable-over-the-air
No one gave an answer yet, perhaps I was wrong about the medium that's why I am also posting the question here.
I am collecting data (by reading input registers) from a machine by RS-485 protocol and Arduino Mega 2560 hardware.
I am also sending this data from Arduino Mega to a NodeMCU which is connected to the internet over WiFi.
I made 100% sure that no physical interference can be performed on the hardware I setup.
But since this machine, I collect data from is controllable (by writing holding registers) over RS-485 (I've tested it) I have to make sure that Arduino's software cannot be changed/re-programmed/flashed over the air by someone.
There is no other device than NodeMCU which is open to the Internet and can be the source of vulnerability. And the only physical connections between Arduino & NodeMCU ar TX3+RX3 pins and power+ground pins.
I do not really care if the data or WiFi password or cloud server credentials are stolen. The only thing I care about is that Arduino is not flashed over the air which can ultimately damage the machine I am taking data from. Do you think this setup is safe regarding the information I present to you?