It may be worthwhile thinking about terminology and what is meant when people say that IoT things have been 'hacked'. In many cases, the devices have not been hacked at all - they are performing as designed.
Broadly speaking, there are two types of network connections. The first type is a fully connected type connection where both parties need to be fully connected. Similar to a phone call, you need to have someone on both ends. With this type of connection, the initiating system makes an initial connection to the destination system and the destination system connects back to the initiating system. This type of connection is what normally occurs when it is important to be able to coordinate communications, track data packet order and request re-sending of any lost data.
The other type of connection is more like a messaging connection (think of SMS or some other messaging In this type of connection, you don't have a bi-directional connection. The originating system sends a message to the destination system and, depending on the message, the receiving system may send back a response to the sender address in the initial message. This type of communication is good when order of data, loss of some data etc is not critical.
The thing is, while fully connected connections are great for things like data integrity and because of the bi-directional nature, are difficult to spoof, they are more expensive in terms of resources and overhead. The second type of connection has less integrity and is easier to spoof because there is no bi-directional connection, but they are cheap - require less resources and have lower system overheads to process.
Many IoT systems are small, lightweight and need to be efficient. They typically have less memory and less powerful processes and therefore tend to favour designs which use connecitonless protocols rather than more expensive connected protocols. However, this also means that it is easier for rogue systems to 'lie' and do things like spoof IP addresses. This is like me sending you a message, where the return address is false. When you reply to the message your reply will go to the address in the message, but that is not the real originating address.
In effect, what is happening is that the IoT devices are being folled into sending data/responses to an innocent bystander who has not requested anything. The system has not been 'hacked', only fooled.
Often, the situation can be made worse by using amplification techniques. There are some connectionless type services out there which, when asked a vary simple/short question, will respond with a vary long answer i.e. answers with lots of data. This can make it vary easy to create a situation where suddenly, a victim site (such as a DNS) suddently starts receiving large amounts of data it was not expecting or did not ask for.
to do this, all you need to do is identify devices on the internet which support a connectionless protocol, send these devices a message which requests something which is likely to involve a large data response and spoof the IP address of the targeted victim.
to make it worse, the targeted system doesn't even need to know or understand the data being sent to it. The idea is to just send so much data that the system becomes overwhelmed - that could happen when the system is forced to look at large amounts of incoming data simply to make a decision to discard it and take no further action. With enough data, even that process of working out you need to just ignore it can be enough to prevent the system from being able to process legitimate connections. The fact that this data is comming from multiple different source systems i.e. all the IoT deices means you cannot just block an IP address because there are simply too many.
So, while it is vary true there are far too many IoT devices which ahve been poorly designed and lack sufficient security controls, a part of the problem is the conflicting requirements to implement a light-weight resource efficient solution on one hand, but somehow deal with a world with too many malicious agents who want to exploit your good intentions. There is certainly a lot IoT vendors could do to improve the situation, but for most of them, this would just increase production costs and the reality is, most consumers are not aware of the issues, so failing to invest in the better solution doesn't affect market share and therefore doesn't result in sufficient financial benefit.