IoT devices get infected because they usually use common software stacks that go un patched. There's crawlers always doing their thing and looking to pop these.

My educated guess: The most common way to get infected is via email.