I also don't see any reason why a provider couldn't offer a customer-controlled firewall option that disables access to everything but specific endpoints for Io

I also don't see any reason why a provider couldn't offer a customer-controlled firewall option that disables access to everything but specific endpoints for IoT devices, especially if the "customer" is the IoT device service provider.