Their security team should vet all of these devices, create environments where it's safe for them to be on the network, and ensure they're kept up to date also?

Yes? How else would they test anything?