Even the really big boys have shit security and almost no one invests in it.
I was called 'insanely paranoid' for not wanting any IoT things in my house even though I am an IT guy.
I told them 'I don't want IoT things in my house BECAUSE I'm an IT guy and know what I'm talking about.'
They ignored me of course, even companies that paid for my opinion and services.
And some paid the price, but funny enough that didn't stop them from insecure practices, it just made them choose another brand of insecure IoT devices to replace the old.