There is a security cost to IOT
There is no such thing as a completely secure system. Add to that many IOT devices are difficult if not impossible to upgrade makes security issues inevitable. But you can do a few things to make things safer.
Don't put the system on the Internet just because you can. My light controller is not on the internet you have to be on the local network to use it.
Change the default user ID and password. admin, admin will not fool anyone.
Keep your whole network upgraded. Two words, Weakest Link
Monitor your system. Security is a continuing issue not a one time event.
Look into security issues when upgrading your system. If you see security issues ask if the benefits outweigh the risks.