Most companies don’t even have an up to date security model for this types of things. IOT very likely requires very flexible but strict row level security on ALL applications. Security should probably be on the data layer but that’s easy to say hard to do. Interesting problem though.
Probably Not. But it can easily yield tons of new insecure, undocumented, unsupervised systems. So it's got that going for it, which is nice.
If a reputable vendor is involved (e.g. Microsoft with AzureSphere) it's a reasonable expectation.
It might just move the problem around and/or give it a bigger attack surface (not only the device, but the cloud can be attacked)