Comment by bsamuels

malicious javascript can only send packets on your rfc1918 network via a DNS rebinding attack, which is not trivial to pull off and is not very reliable

all of these iot devices use upnp to bypass the nat 'firewall'