A lack of investment in cybersecurity protections could imperil the future of smart cities and the IoT devices on which they run, a new report warns.