I mean, a lot of it is more vulnerable than you would think. There's a reason abandoned equipment is supposed to be destroyed.
That said, physical access is the name of the game. Remotely hacking a drone, or any device, would be a big ask without being close enough to see it responding to whatever preliminary access attempts.