The thing is there will be no upgrades for the IoT. Just look at all the Android phones abandoned by their manufacturers. Do you think Phillips is going to pay someone to produce patches for a 5 year old light bulb, or smoke detector, or whatever?
But nowadays malware is less about "hijinks" and more about criminal enterprises that profit from staying hidden, so pressure on device owners and makers is going to have to come from somewhere else: ISPs, governments, ...