There are open IoT standards.

You "can" do these things in a lot of different ways, the unanswered question is what way is best. That's not just a technical question, it also depends on how easy it is to deploy to the general public. If your toothbrush uses Bluetooth then you need to pair it with something that can speak to it, whereas if it can speak to the Internet then that broadens the ability for various systems to talk to it considerably. You can run a webserver they could visit from any browser, apps for phones, etc.

There's no need for a toothbrush to have access to your phone book. But nobody's saying it should. This whole situation of "hacked toothbrushes" isn't real.