This time, 13 devices were evaluated, all of which were remotely exploitable, 12 to root and 6 to root without credentials. https://www.securityevaluators.com/whitepaper/sohopelessly-broken-2/
The whitepaper suggests "patch early, patch often", which is a good idea, but I believe insufficient. As a class of device, we need to additionally plan for IoT exploits and minimize the subsequent blast damage through techniques such as port isolation.
