While I agree this is bad, I think it's a misuse of the term IoT. Webcams have been around since the 90s.
The IoT is turning consumers into inadvertent sysadmins. For the first time in the history of computing, inexpensive consumer products are functioning as servers. These servers are often dreadfully insecure, e.g. internet-accessible root access with a default password.
The market for a $50 IP camera is inherently different to the market for an $800 IP camera.
I had a Linksys WVC11B IP camera like 12 years ago, I don't remember how expensive it was but it was definitely cheap and targeted consumers for home use.
people want a webcam they can plug in and use, most people don't consider the features it offers nor do they secure it beyond what is enabled by default. webcams are a thing, like it or not, and they use the internet, like it or not.
if you think a rascally teenager turning your webcam lights on in the middle of the night is bad, wait until he changes your e-fridge settings and all your food spoils.
For one example, I recently moved into a newly refurbished apartment. It has underfloor heating, with a central control box and remote sensors/controllers in each room. [1] It cost something like €1500-€2500, plus installation, plus the pipes etc.
The central control box has an ethernet port and MicroSD slot, which takes a ZIP downloaded from the manufacturer's site.
I set this up, and was disappointed to see just how terrible the provided software is. There's no Android app, and the iPhone app costs a further €15 [2]. It has only the most basic functionality: see and change the target temperature in a room, and change which program runs (day/night/off/preset1/2/3). The most-needed thing — to change the preset timings without 100 presses of a 5-button LCD interface — isn't possible.
The web interface is the iPhone app implemented as a Java applet making HTTP calls to the server. It's too big to fit on my laptop's screen. There's an 'authenticate' call, but it's optional — the app requires using it, and the call gives the correct pass/fail response, but there's no session handling so there's no need to make this call before reading or changing temperatures.
The Java applet at least means it's not easy to do a Google search for the web interface, but I just found this site [3]. There are a few results, but from a long time ago.
[1] http://www.billigvvs.dk/Varmesystemer-Gulvvarme-Roth-gulvarm...
[2] https://itunes.apple.com/dk/app/roth-touchline/id498448526?m...