And even if they can be updated, consumers and customers must visit the manufacturer’s web site, download a patch and then manually update firmware in the device. Which means even those that may be updated are unlikely to receive timely updates.

Source: No wonder we’re being hit by Internet of Things botnets. Ever tried patching a Thing? • The Register