In the IoT and app viewpoints of a smart-device analysis, which part of the system is easy to overlook?

The development side: the developers, the development and test environments (DEV and test servers) and the deployment path into the app store or onto the device. For IoT devices it is often forgotten.

An app or firmware is not only what runs on the phone or the fridge. It is written by developers, often at an external IT service provider, built and tested against non-production servers, and shipped through an app store or an update channel. Each of those is an actor or interaction that can inject malicious code before the product ever reaches a customer, so they belong inside the system boundary when you analyse "security for the app" or "security for the IoT device".