IoT security is still so nascent that most vendors in it arent really spending much time architecting a secure layer. Frankly they don't really care if their products get co-opted for a DDOS attack. There's no harm to their customer. This will be a huge problem as time goes on.