https://cdn2.hubspot.net/hubfs/486579/avast_smart_home_repor...
Avast have a vested interest in selling security products, so their claim that (paraphrasing) "if one device is vulnerable then the entire home is compromised" isn't at all surprising. Easy way to get that 40.8% figure.
The publication is quite clearly an ad for their Avast Wi-Fi Inspector product.
Most people who have those smart devices aren't really in the technical field. They won't have VLANs segmenting their network, or sniffers watching, let alone a proper firewall.
Look at Mirai; took over smart devices and instead of gaining footholds into everyones network; just used all the outbound traffic.
I wouldn't dismiss the claim just because an AV company said it.
My solution is really quite shoddy but it satisfies me. I took an old router and set it up with its WAN as a LAN client, and its LAN as an IoT network. The router does not have NAT translation on the LAN interface. It does however perform NAT on the openvpn interface. My new IoT network, which is on its own vlan/ssid/however I split layer 2, runs the packets through the vpn and out onto the Internet in some other network, and in theory never shall the two LANs touch. If the vpn goes down, there is no NAT to leak them out my home ISP directly. Sure, I'm doing double nat, but for my IoT stuff, who cares. It's just dye going in the river, just make it go away from me.
I adopted a recurring cost of 3 bucks for a vpn. But I didn't have to get shiny new gear or run an entire computer. My little way for the sake of sharing. Love to hear any criticism of it since I am still thinking about it quite a bit.
I really like Private VLANs over vanilla separate LANs(Physical or via VLAN) because it prevents each client from talking to each other even when they're on the same LAN. From the IoT device's perspective all they can reach is your gateway(192.168.1.1 or whatever) and no other device. So their ability to pivot/snoop on other devices in the network is curtailed.
Sadly it requires hardware support to do right since it's essentially disabling all the switching that exists at the ARP/Switching layer and forcing the device to route through the gateway.
On the UniFi gear this is literally just a checkbox when you're setting up the LAN(guest network vs LAN/corp network) and they handle the rest.