With billions of vulnerable devices, no regulation, a huge attack surface and vast quantities of personal data, IoT checks every box on a cybercriminal's Christmas wish-list.