I agree that asking the right questions will help a lot in IOT security. but the major issue would still the same (from user's side - not vendor): do these IOT devices represent a risk? and the answer is yes. so before adding IOT device to my network, i have to know how i will respond and defend my network in case of possible attack from IOT device.