One of the most important things for securing hardware in IoT devices is to disable and remove the UART and JTAG interfaces, as well as any other diagnostic functionality in the hardware when the device is launched to the market.
The other important consideration here is that, even if there are no exposed interfaces visible, an attacker can directly hook to the legs of the chip to get access to the UART, JTAG, and so on. This is done by reading the datasheet of the chipset, figuring out which pins are for what functionalities, and then making the necessary connections. One of the steps that could be taken here to add a bit of complexity is to have the interfaces deep between different layers via vias and not exposed on one of the visible layers. However, this should be done only if the exposed interfaces are required for the device developer at a later point...
