Decent rules of thumb, though even with root I'd base it more on whether the device really needs general access or not. Speaking of which, a corollary I use is:

Decent rules of thumb, though even with root I'd base it more on whether the device really needs general access or not. Speaking of which, a corollary I use is: if an IOT device requires internet access it's automatically bad and I won't even consider it. If they want to offer some built-in but fully optional "access away from home" that wants to use their cloud that's fine, I can just block that anyway and use VPN. If it wants to access one specific address for updates (though you don't have to) or as an optional passive information feed I can see that. But anything IOT that depends on remote resources for its core functionality is right out. That eliminates a surprising number of IOT devices, but given the flood of crap I think that's no bad thing. These days being able to have something be LAN only with zero service tie-ins seems a decent low pass filter to narrow down choices before diving any deeper.