In theory, sure. But most "real world IoT" devices are appliance-like and seldom designed for the real world nor for non-technical owners. I'd estimate the nu

In theory, sure. But most "real world IoT" devices are appliance-like and seldom designed for the real world nor for non-technical owners. I'd estimate the number of IoT devices with "good and wise security in the design" at being far smaller than 0.1%. Most people designing IoT are NOT CompSci people who remember Therac-200 in class. Most are EEs who often have never had more than one or two programming classes and often often have had no formal training at all. Never mind "security theory" courses. Never mind case studies around that. It's like expecting the average man on the street to be able to perform brain surgery. Worse: no employer is willing to pay for the talent to do the job right. They want it to "work well enough" and "on the cheap" at the same time. Once it's sold, any security issue is someone else's problem (even if it's someone in the same company). And I'm saying this as a degreed EE (I just happened to get into software long before I went to engineering school so I know what I don't know).