The backend component is just as important as the endpoint component. Pretending that IoT is one or the other, but not both is one of the biggest security root causes.
The problem is neither IoT nor ES - whoever built this just didn't bother to implement even basic security.