The CIA, NSA, DHS, etc are all much, much smarter than me, and I would use IoT to compromise targets if it were my job. So there's that data point.