It's easy: they don't. Certificate pinning in IoT devices is pretty unlikely.

If you're lucky, some engineers added signature validation for firmware updates, but then your device is a brick because you can't do anything new with it.