I also feel many don’t understand the full extent, either. They’re used to using fairly secure devices in their everyday life (often not realizing how much the software they install is also spying on them), so why wouldn’t these IoT things also be secure?

In my experience, it’s all very vague and ethereal until the risks are highlighted for them. “So what if Google can read all of my emails? What could they possibly do with that information, anyway; why should I care?” is an example of a portion of a real conversation I’ve had.