Anything connected, especially insecure IoT devices, can and will be exploited by governments, friend or foe, or cyber criminals. That's why we cannot introduce backdoors in encryption. It would invite just about anyone into your private life, causing whatever harm they would like. Every IoT device is an open door if it's not built with security as top priority from start. Adding security later is like painting the pig. The harm might already be done.