With Friends Like Hackers, Who Needs Enemies

In one scenario where someone has physical access to an IoT device, Symantec said, a friend (or foe) could play a prank and reconfigure your IoT devices in what could be the ultimate April Fools trick.
  
“An attacker can gain the highest level of access to the smart home device if they get physical access to it. Although this might seem like an improbable attack vector, it is still a plausible threat. Your friends could gain physical access to your IoT device to play a prank while visiting you,” Symantec wrote.