IoT has a few options and some depends on the application. Many see IoT as the fridge/aircon/etc talking to your web browser, but it is so much more than this and the applications are so varied that really to answer your question fully it would need to be qualified with the application. Here is a overview though.
IoT devices like the fridge/aircon/similar
With the proliferation of small cheap ARM systems that are really small computers (phone/tablet/CHIP/RPi/etc) these devices will be able to run the full node/vault and thus interface fully with SAFE and even could earn coin if the developers were to include the vault s/w, or if the IoT is running say Android/linux you could do it yourself.
IoT devices like house alarm/sensors/billions of other small devices
NOTE: I included house alarms because these are usually the cheap and nasty IoT devices that send their info to a central server to do the real work.
These devices are more likely to small processors and the $5 cost of an ARM and memory is too much, so in these cases to interface with SAFE they will most likely be only sending/receiving messages and/or storing data in files/MDs. At this time the processors in these devices will not be compatible with SAFE official code but hopefully the more powerful devices could perhaps cross compile the code required for messaging and perhaps storing data. If not then there is likely to be a "gateway" device because these devices are unlikely to talk to the internet by themselves anyhow. In that case the "gateway" device can hold the code for the other devices. The "smart" home security system will be similar to this.
Thus the capable device in the local IoT device network will/should be able to integrate with SAFE if the developer designs it in.
There are many other types of IoT devices but this should give you an idea of one way how IoT devices can use SAFE.
The obvious advantages of using SAFE are preserved and is a major improvement over the current security IoT devices use. Things like being certain of the source of a message to essentially being dark devices that cannot be simply discovered by port scanning.