What is the most common vulnerability associated with IoT devices

Question

There are many security risks with IoT, but I’d like to know the single most common vulnerability that affects them.

• Is it default credentials that remain unchanged?
• Do most attacks target unpatched firmware vulnerabilities?
• Are weak encryption methods still a major problem in IoT security?

Looking for expert opinions on the top IoT security flaw and how to mitigate it.