After maintaining online services, I’m quite sure it’s vulnerabilities. It’s extremely costly after 3-5 years to maintain old software.

Ex: You have a thermostat or an alarm system that runs Debian, Debian gets a vulnerability, you try to upgrade it, but you need to change Debian versions, and your old stack isn’t supported on the newer version. Nowadays you need to keep patching all your old appliances, keep the old domain names and exact URLs, and need to actively look for vulnerabilities. All of that can only be provided by a subscription, not the initial purchase cost:

Perhaps it's too radical, but if this is the main concern, you could still build appliances with Linux that just aren't networked. Take a page out of Battlestar Galactica's playbook.

Or at least, only connect to the local network.

That’s an option for a consumer who knows what a VLAN is, but mass-market appliances need to have some barrier to network access.

My smart home stuff is all Z-Wave and my oldest devices are going on 10 years now. A light switch doesn’t need to be maintained or updated. I guess a hacker could drive up to my house with a laptop and a SDR, reverse engineer the protocol and then, I guess, turn my lights on and off? That’s a security tradeoff I’m willing to accept.

Far more likely, is compromised devices are used as part of a botnet to DDoS a target, or as a stepping stone to getting to a more valuable target.

I call it, "collective post nut clarity". The tech looks nice at CES but the users are waking up to the fact they now need to swap their mirror, thermostat, door locks, etc. every few years. Smart LED bulbs are ironic in that LED bulbs were supposed to be so efficient they would save the planet and now people regularly throw them in the garbage for "smart" features. Everything is a con.