Because the S in IOT stands for Security.

IOT devices famously never get firmware updates, which means most of them will remain vulnerable to this leaked trust chain until the cert expires in 2039. That means you can forge an HTTPS server for any domain that an IOT device connects to and act as if you are the authoritative server. This means intercepting encrypted traffic and being able to decrypt it, or serving payloads to the device from a fake trusted server.

If your TV connects to whatever.lg.com, you can create a certificate for that domain using this intermediate signing cert, and pretend to be that server. That's how https://dv-g3b-emudhra.we-have-a-problem.com/ was created.

You can issue a certificate for hxxps://update-server.manufacturer.example or sign any update.zip files using that certificate. If the device requires a specific certificate and/or one under root/intermediate CA that is not eMudhra, e.g. "Manufacturer Product-division Root CA", then that device will not be affected.