It seems like the security (or lack thereof) on many IoT devices makes them soft targets for this type of attack, and that is going to have to be improved. Especially because the owners of these devices are very unlikely to know they have been infected in the first place. Attackers surely know now all the commonly used and default passwords for these devices making them easy to access.
That Chinese firm is actually now fighting back against the allegations and threatening lawsuits against those alleging their fault here, see https://ipvm.com/reports/xiongmai-threaten