IoT devices should not be connected directly to the Internet. I don't want my "smart" lightbulbs to be turned on or off through the Internet. I also don't want them to become yet another way for the NSA to spy on us.
All things that are connected to the Internet can be hacked, let alone things that come with poor security and from manufacturers that never intend to update them either. In fact, the plaftform makers for IoT (or governments if you will) should require manufacturers to update the security vulnerabilities for 80 percent of users until the end of life. For example, if 80 percent of customers keep the smart lightbulb for 5 years, then that's how long they should be updated.
So far Google and ARM's Thread protocol for mesh networking between IoT devices looks interesting and seems focused on security. The devices connect only through a "gateway" through the Internet (which can be your smartphone). That feels like the right approach to me.