I reason this differently in a couple ways: 1) most IoT devices/base stations (though not all) do not expose an interface to the internet, they simply make outb

I reason this differently in a couple ways: 1) most IoT devices/base stations (though not all) do not expose an interface to the internet, they simply make outbound calls across the internet to some service to report stats, send messages, get commands, etc. (In the case of Automatic I believe the "thing" relied on the user's phone to act as the basestation) 2) any device that does expose an interface to the internet will still be exposed even if the central service shuts down. Now if someone actually manages to hack the service itself and use it for malicious purposes (like sending bad commands to the things) that would probably fall on the operator, but securing such services is a problem they could probably get really good at solving.