Many of these IoT devices have incredibly poor security and if they're connected to the internet can be hacked. The bigger models are very good at finding exploits and using them as well, so it could search for devices and break into vulnerable ones then send something to self replicate and start process.

The bigger models might exploit the parents company as well and get in that way. E.g hack a smart security camera company and then find a way into the cameras.