I haven't paid attention to the exploits in many years. But are they still using the Stack buffer overflow to execute the malicious code or are there other techniques modern exploits use?
Assuming that devices don't have cryptographic issues, IoT security is still a mess. So yes firmwares are probably full of BO vulnerabilities. As for more recent techniques, I'm aware of some of them but I'm no expert so I can't comment properly :)