So uh, for various IOT junk like Smart TVs, does that mean the ones that don't get security updates (pretty much all of them) are permanently pwned?

Yes, a blessing and a curse but MiTM sounds like it's very much back on the menu.