Much like rooting mobile phones to get around restrictions on how you can use them. Problem might be that the IoT market is not as concentrated into two or three products. So you would need to have the know-how to lobotomize across many products.

You bring up a valid point.

The ecosystem is going to be huge, so focusing on larger companies, with classical appliance lines (fridge, toaster, TV), that open source their firmware makes sense.

Within a certain product line code gets reused often, so you could work with specific product lines.

Also it really depends on how far you want to go with this and what options the firmware gives you to work with.