The IoT device will still be connected to a LAN/WiFi network to access that gateway. Local attacks will still be possible (imagine a flaw in the TCP/IP stack, local firewall, or anything on that direction). And if that big company gets hacked (never say never), hackers would get access to a huge amount of devices ready-to-pwn. Not even thinking then about what this would mean from a privacy/mass surveillance point of view (by those companies or by agencies infiltrating them).

I can kind of see a device that has no ports open on the local network, and just uses an always-on ssh tunnel to HQ to receive commands. That way it's not exposed to anything on the local network, and it's the company resources that would have to be hacked first.