It's not what the concern is here, it's that this is becoming the norm for all IoT devices, and it is inevitable that in time said devices with comparable secur

It's not what the concern is here, it's that this is becoming the norm for all IoT devices, and it is inevitable that in time said devices with comparable security will have access to more privileged, sensitive information. The principle of least privilege, as a sibling pointed out, is important here because it sets the expectations of what a secure IoT device looks like. If we don't nip it in the bud now, this sort of lax security will become prolific even when more important information is at stake. Google should be leading the pack on 'the right way' to do security on IoT. They know better.