People don't bother to update even their home router's firmware. IoT ecosystem will be one of the biggest holes in cyber security and a heaven for black-hat hackers.
A light bulb that can change its brightness and colour shouldn't be smart; it should be dumb as a brick and expose only those parameters that can sensibly and safely be set by a user — kind of like a normal light bulb does.
I think you meant "is" here.
2. vendors mix feature changes/removals and security updates.
3, better the devil you know...