My most worrisome IoT device I have on my network is a digital picture frame my wife connected, but I was surprised the company routinely updates it even though it's on Android 6 (!).

https://support.frameo.com/hc/en-us/articles/23433637149842-...