None of my IoT devices can be used in a botnet because they are not connected to my wifi for internet access, dont have internet access, and get patches and security updates regularly, because they are all running on open source.

IoT stuff is absolutely fine as long as you're not a moron that thinks marketers need to know your brushing habits and you happily give that data without a second thought.