Yeah, but you are aware of what kind of malice is possible when a device is connected to the internet, most people are not. When a normal person sees "connect your coffee machine to our app so you can start making a coffee when you're still in bed, and it's ready for you by the time you are in the kitchen" it looks like a pretty nice feature, so they look into the reviews of the product.

Most mainstream review sources will also tout these features as positives, and not even mention being careful about what you connect to the internet, so even the people that normal folks trust to inform them are saying it's safe, so they buy the machine and download the app.

The app asks for internet permissions to install a firmware update. Every app-connected product ever does this, so they assume it's a safe thing to do, and they update the machine.

The app, and by extension the coffee machine, now have access to do literally whatever it wants with that internet connection.

Sure, people in this day and age should be aware of what comes with living in a digital world, but if no one is warning them, why would they know?

It should be the responsibility of the company selling the device to disclose what the device will do. Every single piece of data it collects should be mentioned in a manual. Every reason for using the internet should be mentioned. If a company sells a device that collects anything not mentioned in the manual, there should be serious consequences, like the inability to sell products in that country moving forward.

The fact that companies have the ability to have a product do something behind the backs of the consumer is the issue, the issue is not that your average person isn't tech savvy enough to understand that every company and every reviewer is technically lying by omission, and doing so to take advantage of them.