If vendor's website has a vulnerability like CSRF (which are very common because browsers allow cross-domain GET/POST requests by default and developers often d

If vendor's website has a vulnerability like CSRF (which are very common because browsers allow cross-domain GET/POST requests by default and developers often don't realise they should block such requests) then the attacker can gain control over IoT device if they make an employee visit their page.