Only if you give it access

I have a dedicated IOT ssid and vlan (when my Orbi goes, I don’t know what I’ll replace it with…).

Each wifi node on that ssid is in client isolation mode and I carefully monitor where outbound traffic from that segment is headed.

It’s a lot of work, but it makes me feel slightly better about a thermostat, self-hosted security camera setup, and home assistant setup.

It is common behavior for a lot of consumer IoT devices. If it goes on your network and you don’t control the software, you should consider it compromised. Even if the manufacturer isn’t doing outright malicious stuff, it likely isn’t secured very well (they never are) so there’s every chance that someone else could find it and use it as a platform for malicious activity.