Manufacturers need to invest more effort into protecting root-level access to connected devices, security researcher says.