@wimremes wrote:Risk is in the eye of the beholder 🙂
That's true; unfortunately many are blind to the risks or tend to overlook them. Most of us in IT Security are well aware of risks, and take measures to mitigate them --- but not everyone does.
In your case the probability & impact of someone exploiting the info from IoT devices is low, so the residual risk of using such devices is acceptable. I suppose there'd be little / no profit for someone ravaging through a dumpster to find an IoT light-bulb you've used... 
But picture someone whose general IT Security is very lax, like in the situation below:
- Single WiFi network with 1 SSID & a simple password that's rarely --- if ever --- changed.
- End-points not being kept updated or secured with an EPS or firewall.
- Simple account passwords, with little or no use of multi-factor authentication.
- Identical / similar passwords used to secure multiple accounts,
- Information --- including passwords --- stored locally and in plain text.
- Use of info published on social networking sites as answers to security questions.
- Preference to pay up in the event of ransomware attacks with no preventive actions after.
And the list goes on. The scenario I've painted might seem incredulous, but I've seen many like it... 
If this someone is sitting on a gold mine, uses IOT devices & fails to dispose of them properly, the potential gains of retrieving the devices & extracting info from them may be well worth it to someone with motivations.
