Both number of devices and bandwidth could be conserved if we had a standard protocol for these things to talk to a local hub that would (a) proxy interactions with the outside, (b) enforce privacy rules and (c) handle management overhead.
As it is now, a house can easily find itself with three brands of "smart" light bulbs, a thermostat, a power meter, six video systems and a camera: all of them demanding their own IP address and exposing varying levels of private information.
I expect there are six standards for such hubs already. Insert XKCD here...
I am not sure that is is a good idea to put such devices in a special class of their own. It risks giving devices permissions and trust that they don't actually deserve. Better to treat them as an internet server and use existing procotols (OAuth, CORS, TLS, WebSockets etc.). As far as I know all those protocols work perfectly well on a local network behind a NAT. More importantly browsers already have well understood restrictions to prevent XSS built in.
It's not difficult to see that AR/MR/VR will alter our current conception of IoT; imagine the functionality that can be layered onto objects/devices with MR alone. The nature of IoT as embedded robotic systems will become much more apparent, and spacial rendering, and other potential bandwidth intensive sensing capabilities, will push higher upload bandwidth need.
As an aside, is there any practical delineation between "augmented reality" and "mixed reality" that requires the separate terms, outside of a marketing drive to differentiate products?
For me it's simply that I think MR is a better description, but I recognize that AR hasn't been replaced as the preferred term yet, so I include them both. Augmenting our experience of reality is certainly part of the use case, but Mixed seems to capture the overall paradigm change more accurately.