It's also unclear to me if the devices are being connected directly to the public net - I would have expected most homes and businesses to have some kind of fir

It's also unclear to me if the devices are being connected directly to the public net - I would have expected most homes and businesses to have some kind of firewall. I suppose it's possible that UPnP is exposing a web interface and/or telnet.