Comment by eterm

You should assume your IoT junk is already compromised, that's why your IoT junk runs on a dedicated VLAN.