I think the security concern is that IoT devices have such poor security, being behind a firewall is the only thing that stops an attacker compromising them.

Expose the shitty insecure software to the internet directly, the theory goes, and successful attacks are inevitable.