In the IoT and app viewpoints of a smart-device analysis, which part of the system is easy to overlook?

Question

Accepted Answer

The development side: the developers, the development and test environments (DEV and test servers) and the deployment path into the app store or onto the device. For IoT devices it is often forgotten.

* Build, test and delivery are part of the system: each step can inject malicious code before a customer installs anything. *
An app or firmware is not only what runs on the phone or the fridge. It is written by developers, often at an external IT service provider, built and tested against non-production servers, and shipped through an app store or an update channel. Each of those is an actor or interaction that can inject malicious code before the product ever reaches a customer, so they belong inside the system boundary when you analyse "security for the app" or "security for the IoT device".
Go deeper:

Supply chain attack — Wikipedia — real cases where the build and delivery path was the way in.
 MITRE ATT&CK T1195 — Supply Chain Compromise — compromised dev tools, dependencies and update channels.
 NIST SP 800-218 — Secure Software Development Framework — practices for protecting the development environment itself.