You’re assuming a lot here. Most IOT security is on shaky ground. They probably went with the cheapest vendor too. There isn’t a compromise reported but I’m willing to bet that whatever was implemented was very insecure.