What makes the ESP32 a popular choice for connected IoT devices?

It is a cheap microcontroller that combines a dual-core 240 MHz processor, 520 KB of SRAM, built-in Wi-Fi and Bluetooth LE, and hardware-accelerated cryptography on one chip.

Most microcontrollers need an extra radio module to get online. The ESP32 (on the dev board, packaged as the ESP-WROOM-32 module) has it all integrated:

• Compute: a dual-core Tensilica Xtensa LX6 processor at up to 240 MHz (the newer ESP32-S3 uses LX7 cores), with 520 KB of SRAM and 4 MB of flash on the module.
• Connectivity: 802.11 b/g/n Wi-Fi and Bluetooth / Bluetooth LE on the same die, so a sensor can talk directly to a router or a phone.
• Security hardware: accelerators for AES, SHA-2 and RSA, plus big-number multiplication units and a hardware random number generator. There is no dedicated elliptic-curve (ECC) engine on the original ESP32; ECC runs in software, sped up by the big-number units (later chips such as the ESP32-C6 add one). For IoT this matters twice. The crypto runs fast enough that TLS is practical on a microcontroller, and it costs less energy than doing the maths in software.
• Peripherals: SPI, I2C, I2S (audio), UART, PWM, ADC and DAC, so it can drive displays and read almost any sensor.

The ESP32 also supports secure boot and flash encryption, which tie back to the firmware-integrity concerns of IoT security: without them, anyone with the board can read the firmware out of the external flash chip or replace it.

Tip: the combination (radio + crypto + enough RAM for a TLS stack) is the reason, not any single feature.

Go deeper:

• Espressif — ESP32 Series Datasheet (PDF) — the authoritative spec, including the functional block diagram and the crypto accelerators.
• ESP-IDF — Security overview — how secure boot and flash encryption protect the firmware on a deployed ESP32.