Argo floats use them, Slocum gliders and Seagliders use them (underwater AUVs). There's lots of Iridium resellers out there and small companies offering backup GPS tags like RocksBlocks and Novatech and Argos (not too be confused with Argo, or Argos the brand).

We get enough data back to build up vertical profiles of the water column down to like 6000m depth with enough resolution that scientists can pick out physical chemical and biological features of interest. We communicate with the AUVs every couple of hours on average and they are operating all year round. I think there's probably a couple thousand underwater-glider style AUVs and a couple thousand Argo floats being used in total by the world's oceanographic institutes, meteorological institutes, militaries and coastguards etc.

It's a small niche, but a small niche that's been collectively using Iridium for the best part of over 2 decades now and one that is very conservative about change.... Like extraplanetary rovers with radiation hardened hardware, deep sea pressure tested robots use tried and tested stuff so we're a long ways off switching to higher bandwidth alternatives... Especially since Iridium comms are very low power and the modems are easy to integrate into things.. tiny boards which accept AT commands over serial.

It does not suprise me at all that security flaws have been found in Iridium. Most of our applications of it don't even consider security, the hardware itself rarely offers encryption, and old-school Iridium RUDICS requires you to open up a raw TCP port on a server open to the internet for your satellite devices to dial into in RUDICS mode, and if you're using SBD you're sending plaintext emails back and forth to the Iridium gateway service. The whole thing is very "security is not our problem" which means nobody thinks about it. I believe the military versions of one of the underwater glider AUVs has a login prompt now lol, but still sends unencrypted passwords over the plaintext RUDICS connection.