An IoT device that offers a web server for configuration and also runs some network services, and possibly a display?

Ideally, you trust none of them. They are all attack vectors.