How effective are dictionary and brute-force attacks in cracking WPA2?
WPA2 hashes passwords using 4096 iterations of the PBKDF2-HMAC-SHA1. This is not a lot, and there is plenty of GPU-accelerated password cracking software that can guess millions of WPA2 passwords per second, and sometimes more. If your password is not strong, then it's absolutely possible that it can be quickly broken by a dictionary or brute force attack, or a hybrid of the two.
If I were to include WiFi in a security or IoT system, would using a very complicated SSID and passphrase, which would be changed regulary, keep me safe from attacks like those?
A complicated password would keep you safe from password cracking attacks, but a complicated SSID would not have much of an impact on your router security. It might be interesting to note, though, that it does have some effect for people who use weak passwords. For some reason, WPA2 uses the SSID as the password salt. A common or predictable SSID makes rainbow table attacks possible, meaning:
An attacker can attempt to crack multiple passwords at once if the SSIDs are the same.
An attacker can use precomputation to speed up cracking by trading space for speed.
There are places you can download rainbow tables for specific, common router names that could not be used to attack a router with a different SSID. A strong password renders these above issues moot.