My concern about the IoT is not just security and privacy, but with those things as a function of overall management. Let's say for example that my coffee maker is now connecting to the Internet. I now probably have to set up a new account on some web portal run by my coffee maker's manufacturer. Is that site secure? Are they using your email for spam? Is that site leaking privacy information about you?
Even if those concerns are laid to rest, it's still just another account on another website I need to manage. I don't want more accounts, and I especially don't want more accounts on random manufacturer's "cloud-controller" websites for little doodads. And finally, if there is a requirement that the device be controlled from the manufacturer's website or "cloud controller" service, what happens when the manufacturer goes out of business, or when they just decide that they don't want to support that model anymore?