RE: IoT and some general information security considerations...
That a criminal has talked to an infant, posing as Santa, is quite disturbing. Besides worrying if he did it for the realization of a subsequent crime, I think they saw somewhere an idea for an argument of a chapter of a TV series in which a Hacker infiltrated a domestic network and spoke to the girl of the home to do small things as part of a game with his doll, a piece of technology that communicated with the internet to download songs and the latest updates from the manufacturer. In the story, the criminal got the little girl to leave a vulnerability in the security of the house and he took advantage of it to enter, gain physical access to the system and then extort the family with its secrets.
Well, that was a fiction thing, but the idea is not taken away from me that at present what was a story has a great chance of happening.
I also think now, the automation of houses, that of Domotics, and that of vehicles, aimed at being "Driverless", can be a double-edged sword, on the one hand it can facilitate people's lives and support for having greater security, comfort and quality of life ... but, it can also cause vulnerabilities, but not only those that would be caused by hackers and criminal organizations, but also potential violations of privacy by governments and organizations.
I close this comment quite long, pointing out that your advice is very practical and I think they are good rules to reduce the chances of intruders and other problems.