I assume there's an important distinction between general purpose PC traffic and IoT traffic, which is that IoT devices should usually communicate with a small

I assume there's an important distinction between general purpose PC traffic and IoT traffic, which is that IoT devices should usually communicate with a small set of external entities (let's say a vendor service and a user's smartphone). So we can ignore the content of the traffic and instead consider everything malicious by default if it doesn't come from a small set of explicitly trusted addresses. This of course doesn't do anything to secure attacks via one of those trusted addresses, but does prevent someone just happening across an open device. There's also the problem of coping with dynamic addresses, but that can probably be handled separately.