Good lord that's a question and a half.
The worst in a stupid sense would be something silly like an IoT sofa or something.
An idea I had a while ago as to how you could fuck someone over with an insecure IoT device would be to hack into smart lights and turn them on and off at incredibly high speeds in the hopes of starting a fire. (Note: I do not want to hack into lights and start fires)