The device company usually has a bulk data contract with a large telecom. It isn't unusual for IoT device companies to end up as minor telecom providers themselves, buying bandwidth in bulk and reselling it to consumers.