[ocdtrekkie]

Most people aren't equipped to ensure their IP devices can only talk to other LAN devices (I am, my cameras live on a VLAN that can't route to the web). Combine IP capability with the possibility for software updates, and you have botnet fuel. It's why IP cameras are a leading source of botnet participants: Long-lasting IP hardware often managed by users without VLAN segmentation.

[vineyardmike]

I agree that segmenting VLANs and stuff aren’t accessible to average people, but there are accessible alternatives. I recently upgraded to Google WiFi pucks after babysitting a ubiquiti installation for almost half a decade, and you can “disable internet” on devices without disabling LAN. You’d have to trust the device to be friendly on the LAN but it’s good balance for consumers. After Eufys whole security meltdown I updated a bunch of IOT junk to lose internet access. I saw a lot of tech site’s recommend this, and it’s definitely “easy enough for the parents to do”.

[ocdtrekkie]

That's a single proprietary option from a single vendor with its own storied history of both poor privacy and poor long-term hardware support. (I believe they've effectively bricked the first generation of their routers already!)

It's so much smarter to just not have smarthome devices on the network, and have a single interface or bridge which acts as a security barrier.

[vineyardmike]

I think many routers have a simple feature to restrict internet access for a device on the network. I simply highlighted a consumer product (highly recommended by tech sites) that many average consumers may have.

[ocdtrekkie]

This is not a realistic view. Most users do not mess with the settings on their router. Most, do not have this feature either. This isn't a good or practical assumption to make of most home networks.