Don't let your IoT security spoil

from here

Even if browser-based interfaces do make it easier to control such devices, couldn't they be restricted to the local network? Why expose them to the entire world wide web?