Three Questions You Need to Ask About IoT Security and Privacy