> I don't really care if someone can chain together zero-day exploits to "pwn" my lightbulbs.

The point of pwning your lightbulb is not to decide whether it's bright or dark in your house. It's valuable as a residential proxy with a good IP reputation, to be sold to the highest bidder who wants to do something they don't want traced to their own IP.