[bob-09]

I wouldn't say it's THE scenario, but it's A scenario.

There's a reason IEEE says it's best practice to give IoT devices a strong username and password and to segment them away from the rest of your network, right?