Honestly in rare situations that a device like that needs to be accessible from the wild Internet I think it’d be mad to expose it directly, especially if it’s not manageable as you suggest. At the very least, I’d be leaning on a reverse proxy.

About twenty iPods.

Walkers, a snack company, was running a contest where you could enter a draw every ten minutes, 24 hours a day, to win an iPod. They also had a website where you could get an entry code without buying anything. I was one of the few people to have unlimited texts and a phone controllable by Bluetooth at the time, so I ran a script to just spam the free entry codes. Somehow they never cottoned on.