As you see in the the first diagram, there is processing in the 'things-devices' befor ever hitting your local-network/gateway.. this is where security protacols need implimented.
imo
Because in future they may even interface with each other before sending to the gateway and web account.
e