The iot devices are hacked on the application layer. You have a controller running some linux distro and you work your way in over tty/telnet/eth. That’s an entirely different ballgame than repurposing 8-bit avr or 32-bit STM microcontrollers.