Did our final-year project on almost exactly this (smart meters over 2G, we sniffed our own). Everything Laura said. Here’s what I’d do in your position, in this order.

First, split the profile. Make a new profile for the 38 TLS units and leave it on the default, TLS only on 8883. Move them over. That profile’s devices can’t log in on 1883 at all, so even if somebody pokes at them nothing goes in clear.

Second, the 12 old ones get their own profile with plain MQTT allowed, and you lock it down hard:

• Allowed networks: put in only the address range your operator’s traffic comes from. Ask the operator for a private APN if you can, then it’s their private range. Anything outside gets refused (CONNACK 5).
• Commands allowed without TLS: leave it empty, or at most sys.info. Never sys.reboot. Other commands just wait for a TLS session, which these units will never have, so they expire.
• Allowed authentication: only access token if that’s all they use.

Third, rotate the token of the cabinet the tester captured, and honestly all 12, because they’ve been crossing the internet in clear for two years.

Firmware updates and device settings are never sent in clear anyway, so you’re not leaking those. Everything above is on this page: Device transport security. For IT, the honest answer is “38 are encrypted end to end, 12 are not and are fenced in until they’re replaced”.

I fought the Edison breakout for a lab last year. Opening /dev/ttyMFD1 isn’t enough on that board: pins 0 and 1 go through a pin multiplexer and the level shifters, and until those are set up the UART isn’t connected to the header at all, the pins are plain GPIO. That’s why it opens fine and reads nothing.

The easy way is the mraa library, which sets the mux for you when you open the UART by its board number:

import mraa
u = mraa.Uart(0)            # pins 0/1 on the Arduino breakout, sets the mux
u.setBaudRate(115200)
u.setMode(8, mraa.UART_PARITY_NONE, 1)
while True:
    if u.dataAvailable(1000):
        line = u.readStr(64).strip()     # "caps_ok=1823;caps_rej=12"
        vals = dict(kv.split("=") for kv in line.split(";"))
        # add to the payload the Edison already sends:
        payload["caps_ok"] = int(vals["caps_ok"])
        payload["caps_rej"] = int(vals["caps_rej"])

Also check the wiring is crossed: OpenMV TX to the Edison’s RX (pin 0), OpenMV RX to the Edison’s TX (pin 1). Pin 0 is RX on the breakout, so if what you wrote is exactly how it’s wired, swap them.