I can understand the need for IoT device in industry, such as remote monitoring of device in the field. For home use I have yet to see a device that make any sense. IoT is at this point complete marketing hype, and very little practical application.
The only two exceptions are my phone (hard to avoid) and my radiator thermostats.
For the latter, they are connected to the internet and I can adjust temperature and put them in "holiday mode" from an app or web page. However the control box doesn't require any firewall holes or port openings, as far as I can tell it gets updates by sending a HTTP request to the same online portal where I can control my heating schedules.
It communicates with the thermostats and window sensors on some kind of RF protocol similar to Z-wave, but if someone goes to the effort of hacking that just to mess with my heating, I would actually be a bit flattered.
I probably wouldn't choose the internet-connected version again. Even though it is a lot easier to setup and manage, I think I would prefer the "dumb" standalone units. They're a bit more fiddly to setup initially, and you have to put each of them to holiday mode manually. But I would prefer to not have them connected to any kind of network.
I used to be the type of person who wanted everything 100% connected 100% of the time. Over the last couple of years, I've taken a pretty hard turn in the opposite direction, I prefer to have everything as simple and standalone as possible.
Slightly off-topic but I have a thermostat that only turns on when my phone (or me) is on the way home and it automatically turns it off when I leave my home.
It saves me _considerable_ amount on my heating bill, especially since I'm not home on a regular schedule and often don't know until hours in advance.
Smart devices are fine for me. Using them as an excuse to turn a product into a service isn't.