When I tried to lock down my smart thermostats, I discovered how hard it is to control what IoT devices connect to. Here’s what I learned—and why we need NetBOM.