The IoT startups are trying to get market share right now so they don't care at all about security. About a year ago I went to an IoT startup interview and asked if they used ssl when transferring data to and from the devices. Answer: at this stage it doesn't justify the investment, we're on vc money now and we need to get clients first.. It's going to get crazy when this becomes a real fad..