About a decade ago, @soumyab8 and I built a system to prevent precisely these kinds of attacks. The core idea was that commands issued to actuators (eg fridges) would have to furnish a safety proof that they fulfill the user's desired policy, thus preventing an attacker from wreaking havoc even if they have compromised a centralized controller. The reviewers back in the day thought it was too far fetched. Hah.