Yeah. We’re too used to that being the normal thing to do. It vaguely makes sense in some scenarios, like to see if there has been a firmware update. If there’s a security issue you either want the device to update automatically or you want to be able to notify the user. But, even then, there are other ways of doing it that don’t involve the device sending traffic to the Internet. IoT should really be made from devices that are unable to exchange traffic with anything outside the local network.

Even if you come up with a plausible scenario where maybe you’d want a device to be accessible outside your home (i.e. you want to start your coffee maker before you get home) that could be done without the device having access to the outside world. It would be easy to set up a device which can accept outside messages (“make coffee”) and forward them on to devices inside the network. There are ways of making that much more secure. And, if that’s the case, needing the latest security update for an IoT device is less urgent.