The joke that S in "IoT" stands for Security is as old as the term itself, but there were no such clear incentives for exploiting them before, beyond basic DDoS and more recently crypto mining.