they're not going to go after the robot vacuum when the thermostat, tablets, computers, TV, router, access point, etc are right there.

… and all of those things should be equally protected

they’re going to go for the easiest thing to extract information or escalate

since they have root they can add a password themselves!

the most absurd thing is assuming that an end-user is going do add a root password to a serial interface

i’m not saying end users shouldn’t be able to gain root somehow, simply that it shouldn’t be wide open by default… there should be some process, perhaps involving a unique password per device