>I work at an IoT company and we take security far more seriously than some would say is necessary or even reasonable.

Then you are a member of a miniscule minority.

The backing argument is a ballooning threat surface that can never reliably be patched