SPECK is probably fine. It's a pretty ordinary-looking design, if some 25 year old up-and-coming crypto academic proposed this for an application, nobody would freak out about how maybe it's a cunning trick to steal all our data. But because the NSA was involved and wasn't willing to share whatever methods they're currently using to check this was OK that's apparently reason to shoot it down.

And even though RC4 is very broken (unlike SPECK) it'd still actually be a lot of work to attack many practical applications of RC4. One of the strange things the Web gave us is a real application that looks like the outrageously convenient models in a cryptography class. Want one of the participants to repeatedly send a known plaintext using millions of different keys so you can see what that looks like? Javascript! Need to ensure your payload data is right next to the mystery data you need to decrypt? Cookies! Need to convince a participant to connect to your hostile system and decrypt large volumes of data? Embedded images and HTML email! So on the web, you can build a toy demo that breaks RC4, not really in a real time (I guess at a multi-day conference you could do an afternoon session "Preparing to break RC4" and then a morning session the next day "See, it worked") but for most protocols the attack is not practical. Attacks of course, only get better, so, this is not telling anybody to use RC4 but only underscoring how high the bar is here.

Should you use RC4? No. Definitely not. But is the RC4-encryption for the IoT data feed the weakest link in your system today? Almost certainly also no.

Am I going to buy a GPU or a wrench to crack a password? Most definitely a wrench.

I honestly do think if the data only has to be protected for a day, just use RC4 (or something similar).

It’s pretty obvious the data is worth nothing if it’s not even worth an extra battery to properly encrypt.